| Index: src/ia32/lithium-codegen-ia32.cc
|
| diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
|
| index f3bcf1abc3fc1974af2b7bd55a8aeec35aec8269..1e744a64e101c7482cc7d622d4a4e3d6661cc18d 100644
|
| --- a/src/ia32/lithium-codegen-ia32.cc
|
| +++ b/src/ia32/lithium-codegen-ia32.cc
|
| @@ -2705,6 +2705,10 @@ Operand LCodeGen::BuildFastArrayOperand(
|
| uint32_t additional_index) {
|
| Register elements_pointer_reg = ToRegister(elements_pointer);
|
| int shift_size = ElementsKindToShiftSize(elements_kind);
|
| + // Even though the HLoad/StoreKeyedFastElement instructions force the input
|
| + // representation for the key to be an integer, the input gets replaced during
|
| + // bound check elimination with the index argument to the bounds check, which
|
| + // can be tagged, so that case must be handled here, too.
|
| if (key_representation.IsTagged() && (shift_size >= 1)) {
|
| shift_size -= kSmiTagSize;
|
| }
|
| @@ -3681,8 +3685,14 @@ void LCodeGen::DoStoreNamedGeneric(LStoreNamedGeneric* instr) {
|
|
|
| void LCodeGen::DoBoundsCheck(LBoundsCheck* instr) {
|
| if (instr->index()->IsConstantOperand()) {
|
| - __ cmp(ToOperand(instr->length()),
|
| - Immediate(ToInteger32(LConstantOperand::cast(instr->index()))));
|
| + int constant_index =
|
| + ToInteger32(LConstantOperand::cast(instr->index()));
|
| + if (instr->hydrogen()->length()->representation().IsTagged()) {
|
| + __ cmp(ToOperand(instr->length()),
|
| + Immediate(Smi::FromInt(constant_index)));
|
| + } else {
|
| + __ cmp(ToOperand(instr->length()), Immediate(constant_index));
|
| + }
|
| DeoptimizeIf(below_equal, instr->environment());
|
| } else {
|
| __ cmp(ToRegister(instr->index()), ToOperand(instr->length()));
|
|
|