Reviewers: Yang,
Description:
Do not eliminate bounds checks for "<const> - x".
Before this change, bounds check elimination treated "<const> - x" as
"x - <const>".
[email protected]
BUG=385054
TEST=test/mjsunit/regress/regress-385054.js
LOG=N
Please review this at https://codereview.chromium.org/339583003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+9, -12 lines):
M src/hydrogen-bce.cc
A + test/mjsunit/regress/regress-385054.js
Index: src/hydrogen-bce.cc
diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
index
c72a8c55d865f7bfdf4c7e21c675a710fd3b9ddd..5b134290ee7a08e9342e206d3425a7b94574974c
100644
--- a/src/hydrogen-bce.cc
+++ b/src/hydrogen-bce.cc
@@ -47,10 +47,7 @@ class BoundsCheckKey : public ZoneObject {
} else if (check->index()->IsSub()) {
HSub* index = HSub::cast(check->index());
is_sub = true;
- if (index->left()->IsConstant()) {
- constant = HConstant::cast(index->left());
- index_base = index->right();
- } else if (index->right()->IsConstant()) {
+ if (index->right()->IsConstant()) {
constant = HConstant::cast(index->right());
index_base = index->left();
}
Index: test/mjsunit/regress/regress-385054.js
diff --git a/test/mjsunit/regress/regress-alloc-smi-check.js
b/test/mjsunit/regress/regress-385054.js
similarity index 69%
copy from test/mjsunit/regress/regress-alloc-smi-check.js
copy to test/mjsunit/regress/regress-385054.js
index
295048a13ef862ceb21939de104e7968dd7772da..115bca0d21989e2a82325aeb66d8c06aa5ab198c
100644
--- a/test/mjsunit/regress/regress-alloc-smi-check.js
+++ b/test/mjsunit/regress/regress-385054.js
@@ -1,16 +1,16 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
-var x = {};
+// Flags: --allow-natives-syntax
-function f(a) {
- a[200000000] = x;
+function f(x) {
+ var a = [1, 2];
+ a[x];
+ return a[0 - x];
}
-f(new Array(100000));
-f([]);
+f(0);
+f(0);
%OptimizeFunctionOnNextCall(f);
-f([]);
+assertEquals(undefined, f(1));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
