Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(149)

Unified Diff: src/crankshaft/hydrogen.cc

Issue 1621623002: [crankshaft] For-in index increment cannot overflow. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@FLAG_optimize_for_in
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-3650-1.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/crankshaft/hydrogen.cc
diff --git a/src/crankshaft/hydrogen.cc b/src/crankshaft/hydrogen.cc
index c7185c98f2ca2696a90278ca8efa3318ccdc5352..f56f362f3a63b286333d3d93ba0a3629c2ed7564 100644
--- a/src/crankshaft/hydrogen.cc
+++ b/src/crankshaft/hydrogen.cc
@@ -5444,7 +5444,10 @@ void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
set_current_block(body_exit);
HValue* current_index = Pop();
- Push(AddUncasted<HAdd>(current_index, graph()->GetConstant1()));
+ HValue* increment =
+ AddUncasted<HAdd>(current_index, graph()->GetConstant1());
+ increment->ClearFlag(HValue::kCanOverflow);
+ Push(increment);
body_exit = current_block();
}
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-3650-1.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698