Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(159)

Side by Side Diff: src/hydrogen-bce.cc

Issue 1023123003: Ensure we don't overflow in BCE (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-bce-underflow.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2013 the V8 project authors. All rights reserved. 1 // Copyright 2013 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/hydrogen-bce.h" 5 #include "src/hydrogen-bce.h"
6 6
7 namespace v8 { 7 namespace v8 {
8 namespace internal { 8 namespace internal {
9 9
10 10
(...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after
49 is_sub = true; 49 is_sub = true;
50 if (index->right()->IsConstant()) { 50 if (index->right()->IsConstant()) {
51 constant = HConstant::cast(index->right()); 51 constant = HConstant::cast(index->right());
52 index_base = index->left(); 52 index_base = index->left();
53 } 53 }
54 } else if (check->index()->IsConstant()) { 54 } else if (check->index()->IsConstant()) {
55 index_base = check->block()->graph()->GetConstant0(); 55 index_base = check->block()->graph()->GetConstant0();
56 constant = HConstant::cast(check->index()); 56 constant = HConstant::cast(check->index());
57 } 57 }
58 58
59 if (constant != NULL && constant->HasInteger32Value()) { 59 if (constant != NULL && constant->HasInteger32Value() &&
60 constant->Integer32Value() != kMinInt) {
60 *offset = is_sub ? - constant->Integer32Value() 61 *offset = is_sub ? - constant->Integer32Value()
61 : constant->Integer32Value(); 62 : constant->Integer32Value();
62 } else { 63 } else {
63 *offset = 0; 64 *offset = 0;
64 index_base = check->index(); 65 index_base = check->index();
65 } 66 }
66 67
67 return new(zone) BoundsCheckKey(index_base, check->length()); 68 return new(zone) BoundsCheckKey(index_base, check->length());
68 } 69 }
69 70
(...skipping 386 matching lines...) Expand 10 before | Expand all | Expand 10 after
456 if (data->FatherInDominatorTree()) { 457 if (data->FatherInDominatorTree()) {
457 table_.Insert(data->Key(), data->FatherInDominatorTree(), zone()); 458 table_.Insert(data->Key(), data->FatherInDominatorTree(), zone());
458 } else { 459 } else {
459 table_.Delete(data->Key()); 460 table_.Delete(data->Key());
460 } 461 }
461 data = data->NextInBasicBlock(); 462 data = data->NextInBasicBlock();
462 } 463 }
463 } 464 }
464 465
465 } } // namespace v8::internal 466 } } // namespace v8::internal
OLDNEW
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-bce-underflow.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698