From f69bb7fcc3285215ac0ffb6292d0ffb8db13ad18 Mon Sep 17 00:00:00 2001 From: "jarin@chromium.org" Date: Mon, 16 Jun 2014 13:43:50 +0000 Subject: [PATCH] Do not eliminate bounds checks for " - x". Before this change, bounds check elimination treated " - x" as "x - ". R=yangguo@chromium.org BUG=385054 TEST=test/mjsunit/regress/regress-385054.js LOG=N Review URL: https://codereview.chromium.org/339583003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21859 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/hydrogen-bce.cc | 5 +---- test/mjsunit/regress/regress-385054.js | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 test/mjsunit/regress/regress-385054.js diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc index c72a8c55d..5b134290e 100644 --- a/src/hydrogen-bce.cc +++ b/src/hydrogen-bce.cc @@ -47,10 +47,7 @@ class BoundsCheckKey : public ZoneObject { } else if (check->index()->IsSub()) { HSub* index = HSub::cast(check->index()); is_sub = true; - if (index->left()->IsConstant()) { - constant = HConstant::cast(index->left()); - index_base = index->right(); - } else if (index->right()->IsConstant()) { + if (index->right()->IsConstant()) { constant = HConstant::cast(index->right()); index_base = index->left(); } diff --git a/test/mjsunit/regress/regress-385054.js b/test/mjsunit/regress/regress-385054.js new file mode 100644 index 000000000..115bca0d2 --- /dev/null +++ b/test/mjsunit/regress/regress-385054.js @@ -0,0 +1,16 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f(x) { + var a = [1, 2]; + a[x]; + return a[0 - x]; +} + +f(0); +f(0); +%OptimizeFunctionOnNextCall(f); +assertEquals(undefined, f(1)); -- 2.34.1