HGraphBuilder::BuildJSObjectCheck: Tighten instance type comparison

R=danno@chromium.org

Review URL: https://codereview.chromium.org/366083005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22206 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index d21541b281c6b5d9a6aa6a10e1d0c74abf06ad18..954cb627d2a728f6fbab71766ab8606ef2901bc8 100644 (file)
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1431,7 +1431,8 @@ void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
                                              mask);
   HValue* sub_result = AddUncasted<HSub>(and_result,
                                          Add<HConstant>(JS_OBJECT_TYPE));
-  Add<HBoundsCheck>(sub_result, Add<HConstant>(0x100 - JS_OBJECT_TYPE));
+  Add<HBoundsCheck>(sub_result,
+                    Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
 }