Revision: 21859
Author: [email protected]
Date: Mon Jun 16 13:43:50 2014 UTC
Log: Do not eliminate bounds checks for "<const> - x".
Before this change, bounds check elimination treated "<const> - x" as
"x - <const>".
[email protected]
BUG=385054
TEST=test/mjsunit/regress/regress-385054.js
LOG=N
Review URL: https://codereview.chromium.org/339583003
http://code.google.com/p/v8/source/detail?r=21859
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-385054.js
Modified:
/branches/bleeding_edge/src/hydrogen-bce.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-385054.js Mon Jun
16 13:43:50 2014 UTC
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ var a = [1, 2];
+ a[x];
+ return a[0 - x];
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(1));
=======================================
--- /branches/bleeding_edge/src/hydrogen-bce.cc Wed Jun 4 11:52:17 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen-bce.cc Mon Jun 16 13:43:50 2014 UTC
@@ -47,10 +47,7 @@
} else if (check->index()->IsSub()) {
HSub* index = HSub::cast(check->index());
is_sub = true;
- if (index->left()->IsConstant()) {
- constant = HConstant::cast(index->left());
- index_base = index->right();
- } else if (index->right()->IsConstant()) {
+ if (index->right()->IsConstant()) {
constant = HConstant::cast(index->right());
index_base = index->left();
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
