From: Benedikt Meurer <bmeurer@chromium.org>
Date: Mon, 22 Dec 2014 08:27:42 +0000 (+0100)
Subject: [turbofan] Correctify lowering of Uint8ClampedArray buffer access.
X-Git-Tag: upstream/4.7.83~5124
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=65e69497abe207f5c06d7923632b7d10541bb35b;p=platform%2Fupstream%2Fv8.git

[turbofan] Correctify lowering of Uint8ClampedArray buffer access.

TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/794013004

Cr-Commit-Position: refs/heads/master@{#25916}
---

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index f5bb09d..2338866 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -781,7 +781,6 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
     double const byte_length = array->byte_length()->Number();
     CHECK_LT(k, arraysize(shifted_int32_ranges_));
     if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
-        access.external_array_type() != kExternalUint8ClampedArray &&
         key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
       // JSLoadProperty(typed-array, int32)
       Handle<ExternalArray> elements =
diff --git a/src/compiler/simplified-operator.cc b/src/compiler/simplified-operator.cc
index 4900048..e082a4b 100644
--- a/src/compiler/simplified-operator.cc
+++ b/src/compiler/simplified-operator.cc
@@ -28,6 +28,7 @@ std::ostream& operator<<(std::ostream& os, BaseTaggedness base_taggedness) {
 MachineType BufferAccess::machine_type() const {
   switch (external_array_type_) {
     case kExternalUint8Array:
+    case kExternalUint8ClampedArray:
       return kMachUint8;
     case kExternalInt8Array:
       return kMachInt8;
@@ -43,8 +44,6 @@ MachineType BufferAccess::machine_type() const {
       return kMachFloat32;
     case kExternalFloat64Array:
       return kMachFloat64;
-    case kExternalUint8ClampedArray:
-      break;
   }
   UNREACHABLE();
   return kMachNone;
diff --git a/test/mjsunit/compiler/regress-444508.js b/test/mjsunit/compiler/regress-444508.js
new file mode 100644
index 0000000..e7d51ae
--- /dev/null
+++ b/test/mjsunit/compiler/regress-444508.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function Module(stdlib, foreign, heap) {
+  "use asm";
+  // This is not valid asm.js, but should nevertheless work.
+  var MEM = new Uint8ClampedArray(heap);
+  function foo(i) { MEM[0] = 1; }
+  return {foo: foo};
+})(this, {}, new ArrayBuffer(64 * 1024)).foo();