Reviewers: Yang,
Description:
[turbofan] Fix invalid access to Parameter index.
A Parameter operator contains a ParameterInfo payload, not an int
payload, so the OpParameter<int> cast is invalid (and only worked by
coincidence currently).
BUG=chromium:515215
LOG=n
[email protected]
Please review this at https://codereview.chromium.org/1266743002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+6, -5 lines):
M src/compiler/typer.cc
Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index
3f4bd27ec6a3ce875d40ee962924a02fe0fc512b..85b73c825f549da003767458007df90f19f5ec54
100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -7,6 +7,7 @@
#include "src/base/flags.h"
#include "src/base/lazy-instance.h"
#include "src/bootstrapper.h"
+#include "src/compiler/common-operator.h"
#include "src/compiler/graph-reducer.h"
#include "src/compiler/js-operator.h"
#include "src/compiler/node.h"
@@ -571,11 +572,11 @@ Bounds Typer::Visitor::TypeIfException(Node* node) {
Bounds Typer::Visitor::TypeParameter(Node* node) {
- int param = OpParameter<int>(node);
- Type::FunctionType* function_type = typer_->function_type();
- if (function_type != nullptr && param >= 0 &&
- param < static_cast<int>(function_type->Arity())) {
- return Bounds(Type::None(), function_type->Parameter(param));
+ if (Type::FunctionType* function_type = typer_->function_type()) {
+ int const index = ParameterIndexOf(node->op());
+ if (index >= 0 && index < function_type->Arity()) {
+ return Bounds(Type::None(), function_type->Parameter(index));
+ }
}
return Bounds::Unbounded(zone());
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
