Do not eliminate bounds checks for "<const> - x".

Before this change, bounds check elimination treated "<const> - x" as
"x - <const>".

R=yangguo@chromium.org
BUG=385054
TEST=test/mjsunit/regress/regress-385054.js
LOG=N

Review URL: https://codereview.chromium.org/339583003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
index c72a8c55d865f7bfdf4c7e21c675a710fd3b9ddd..5b134290ee7a08e9342e206d3425a7b94574974c 100644 (file)
--- a/src/hydrogen-bce.cc
+++ b/src/hydrogen-bce.cc
@@ -47,10 +47,7 @@ class BoundsCheckKey : public ZoneObject {
     } else if (check->index()->IsSub()) {
       HSub* index = HSub::cast(check->index());
       is_sub = true;
-      if (index->left()->IsConstant()) {
-        constant = HConstant::cast(index->left());
-        index_base = index->right();
-      } else if (index->right()->IsConstant()) {
+      if (index->right()->IsConstant()) {
         constant = HConstant::cast(index->right());
         index_base = index->left();
       }

diff --git a/test/mjsunit/regress/regress-385054.js b/test/mjsunit/regress/regress-385054.js
new file mode 100644 (file)
index 0000000..115bca0
--- /dev/null
+++ b/test/mjsunit/regress/regress-385054.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+  var a = [1, 2];
+  a[x];
+  return a[0 - x];
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(1));