Int32Matcher mlength(length);
Int32BinopMatcher moffset(offset);
if (mlength.HasValue() && moffset.right().HasValue() &&
+ moffset.right().Value() >= 0 &&
mlength.Value() >= moffset.right().Value()) {
Emit(opcode, g.DefineAsRegister(node), g.UseRegister(buffer),
g.UseRegister(moffset.left().node()),
Int32Matcher mlength(length);
Int32BinopMatcher moffset(offset);
if (mlength.HasValue() && moffset.right().HasValue() &&
+ moffset.right().Value() >= 0 &&
mlength.Value() >= moffset.right().Value()) {
Emit(opcode, nullptr, g.UseRegister(buffer),
g.UseRegister(moffset.left().node()),
--- /dev/null
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var foo = (function Module(stdlib, foreign, heap) {
+ "use asm";
+ var MEM16 = new stdlib.Int16Array(heap);
+ function foo(i) {
+ i = i|0;
+ i = MEM16[i + 2147483650 >> 1]|0;
+ return i;
+ }
+ return { foo: foo };
+})(this, {}, new ArrayBuffer(64 * 1024)).foo;
+
+foo(0);