Revision: 20363
Author: dslo...@chromium.org
Date: Mon Mar 31 15:14:28 2014 UTC
Log: Fix PrepareKeyedOperand on arm.
When additional_offset is specified, the 'key' operand can be negative
and still pass the bounds check. Therefore, when converting key from
Smi, arithmetic and not logical shift must be used.
R=verwa...@chromium.org
BUG=358057
LOG=Y
Review URL: https://codereview.chromium.org/219473002
http://code.google.com/p/v8/source/detail?r=20363
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-358057.js
Modified:
/branches/bleeding_edge/src/arm/lithium-codegen-arm.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-358057.js Mon Mar
31 15:14:28 2014 UTC
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+__v_0 = new Uint8ClampedArray(10);
+for (var i = 0; i < 10; i++) {
+ __v_0[i] = 0xAA;
+}
+function __f_12(__v_6) {
+ if (__v_6 < 0) {
+ __v_1 = __v_0[__v_6 + 10];
+ return __v_1;
+ }
+}
+
+assertEquals(0xAA, __f_12(-1));
+%OptimizeFunctionOnNextCall(__f_12);
+assertEquals(0xAA, __f_12(-1));
=======================================
--- /branches/bleeding_edge/src/arm/lithium-codegen-arm.cc Mon Mar 31
14:21:04 2014 UTC
+++ /branches/bleeding_edge/src/arm/lithium-codegen-arm.cc Mon Mar 31
15:14:28 2014 UTC
@@ -3309,7 +3309,8 @@
__ add(scratch0(), scratch0(), Operand(key, LSL, shift_size));
} else {
ASSERT_EQ(-1, shift_size);
- __ add(scratch0(), scratch0(), Operand(key, LSR, 1));
+ // key can be negative, so using ASR here.
+ __ add(scratch0(), scratch0(), Operand(key, ASR, 1));
}
return MemOperand(base, scratch0());
}
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
