Index: src/x64/ic-x64.cc |
=================================================================== |
--- src/x64/ic-x64.cc (revision 2604) |
+++ src/x64/ic-x64.cc (working copy) |
@@ -424,6 +424,9 @@ |
// Check that the key is a smi. |
__ testl(rbx, Immediate(kSmiTagMask)); |
__ j(not_zero, &slow); |
+ // If it is a smi, make sure it is zero-extended, so it can be |
+ // used as an index in a memory operand. |
+ __ movl(rbx, rbx); // Clear the high bits of rbx. |
__ CmpInstanceType(rcx, JS_ARRAY_TYPE); |
__ j(equal, &array); |
@@ -434,7 +437,7 @@ |
// Object case: Check key against length in the elements array. |
// rax: value |
// rdx: JSObject |
- // rbx: index (as a smi) |
+ // rbx: index (as a smi), zero-extended. |
__ movq(rcx, FieldOperand(rdx, JSObject::kElementsOffset)); |
// Check that the object is in fast mode (not dictionary). |
__ Cmp(FieldOperand(rcx, HeapObject::kMapOffset), Factory::fixed_array_map()); |