Reviewers: Michael Achenbach,
Message:
PTAL
Description:
[turbofan] Correctify lowering of Uint8ClampedArray buffer access.
TEST=mjsunit/compiler/regress-444508.js
BUG=chromium:444508
LOG=y
Please review this at https://codereview.chromium.org/794013004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+12, -3 lines):
M src/compiler/js-typed-lowering.cc
M src/compiler/simplified-operator.cc
A test/mjsunit/compiler/regress-444508.js
Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc
b/src/compiler/js-typed-lowering.cc
index
f5bb09d1b2016927404848c609d8a0683302614a..2338866d6d2274830dff5b132128ca3f9216659b
100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -781,7 +781,6 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node*
node) {
double const byte_length = array->byte_length()->Number();
CHECK_LT(k, arraysize(shifted_int32_ranges_));
if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
- access.external_array_type() != kExternalUint8ClampedArray &&
key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
// JSLoadProperty(typed-array, int32)
Handle<ExternalArray> elements =
Index: src/compiler/simplified-operator.cc
diff --git a/src/compiler/simplified-operator.cc
b/src/compiler/simplified-operator.cc
index
4900048829c889c7dacbaf18259817f6dcda0472..e082a4b30a827f68001b7c5772e5d660cf176cd0
100644
--- a/src/compiler/simplified-operator.cc
+++ b/src/compiler/simplified-operator.cc
@@ -28,6 +28,7 @@ std::ostream& operator<<(std::ostream& os, BaseTaggedness
base_taggedness) {
MachineType BufferAccess::machine_type() const {
switch (external_array_type_) {
case kExternalUint8Array:
+ case kExternalUint8ClampedArray:
return kMachUint8;
case kExternalInt8Array:
return kMachInt8;
@@ -43,8 +44,6 @@ MachineType BufferAccess::machine_type() const {
return kMachFloat32;
case kExternalFloat64Array:
return kMachFloat64;
- case kExternalUint8ClampedArray:
- break;
}
UNREACHABLE();
return kMachNone;
Index: test/mjsunit/compiler/regress-444508.js
diff --git a/test/mjsunit/compiler/regress-444508.js
b/test/mjsunit/compiler/regress-444508.js
new file mode 100644
index
0000000000000000000000000000000000000000..e7d51ae831fd0c20dcbac1e825ac3740bcb7e953
--- /dev/null
+++ b/test/mjsunit/compiler/regress-444508.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function Module(stdlib, foreign, heap) {
+ "use asm";
+ // This is not valid asm.js, but should nevertheless work.
+ var MEM = new Uint8ClampedArray(heap);
+ function foo(i) { MEM[0] = 1; }
+ return {foo: foo};
+})(this, {}, new ArrayBuffer(64 * 1024)).foo();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
