BoundsCheck should be extended to support array_bounds_checks_elimination

test/mjsunit/array-bounds-check-removal.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 105 matching lines @@
 check_test_minus(7,true);
 test_minus(7,false);
 check_test_minus(7,false);
 
 // Optimization status:
 // YES: 1
 // NO: 2
 // ALWAYS: 3
 // NEVER: 4
 
-if (false) {
+if (true) {
 test_base(5,true);
 test_base(6,true);
 test_base(5,false);
 test_base(6,false);
 %OptimizeFunctionOnNextCall(test_base);
 test_base(-2,true);
 assertTrue(%GetOptimizationStatus(test_base) != 1);
 
 test_base(5,true);
 test_base(6,true);
 test_base(5,false);
 test_base(6,false);
 %OptimizeFunctionOnNextCall(test_base);
 test_base(2048,true);
 assertTrue(%GetOptimizationStatus(test_base) != 1);
 }
 
 gc();
 
+var b1 = new Array(2000);
+var b2 = new Array(200);
+
+function test_bounds_calc_overflow(a,base) {
+  a[base + 11] = 3;
+  a[base] = 4;
+  a[base + 999] = 5;
+}
+
+var i;
+var b0 = new Array(10000);
+for (i = 0; i < b0.length; i++)
+  b0[i] = 0xFEED;
+
+test_bounds_calc_overflow(b1, 10);
+%OptimizeFunctionOnNextCall(test_bounds_calc_overflow);
+test_bounds_calc_overflow(b2, 0);
+
+for (i = 0; i < b0.length; i++)
+  assertEquals(0xFEED, b0[i]);
+assertEquals(1000, b2.length);
+assertEquals(5, b2[999]);
+assertTrue(%GetOptimizationStatus(test_bounds_calc_overflow) != 1);