Chromium Code Reviews| Index: src/runtime/runtime-simd.cc | 
| diff --git a/src/runtime/runtime-simd.cc b/src/runtime/runtime-simd.cc | 
| index 9e5614242a656d882f31856c84519eb12d715d8b..187c583ca215fe7c5c26207cc5097b36cfd17018 100644 | 
| --- a/src/runtime/runtime-simd.cc | 
| +++ b/src/runtime/runtime-simd.cc | 
| @@ -168,9 +168,20 @@ RUNTIME_FUNCTION(Runtime_IsSimdValue) { | 
| // Utility macros. | 
| -#define CONVERT_SIMD_LANE_ARG_CHECKED(name, index, lanes) \ | 
| - CONVERT_INT32_ARG_CHECKED(name, index); \ | 
| - RUNTIME_ASSERT(name >= 0 && name < lanes); | 
| +#define CONVERT_SIMD_LANE_ARG_CHECKED(name, index, lanes) \ | 
| + Handle<Object> name_object; \ | 
| + ASSIGN_RETURN_FAILURE_ON_EXCEPTION( \ | 
| + isolate, name_object, Object::ToNumber(args.at<Object>(index))); \ | 
| + if (!name_object->IsNumber()) { \ | 
| 
 
bbudge
2016/05/11 18:33:16
Can't you assume name_object is a number at this p
 
gdeepti
2016/05/17 14:59:41
Removed index coercion here as the polyfill does n
 
 | 
| + THROW_NEW_ERROR_RETURN_FAILURE( \ | 
| + isolate, NewTypeError(MessageTemplate::kInvalidSimdOperation)); \ | 
| + } \ | 
| + uint32_t name; \ | 
| + name = name_object->Number(); \ | 
| + if (name < 0 || name >= lanes) { \ | 
| + THROW_NEW_ERROR_RETURN_FAILURE( \ | 
| + isolate, NewRangeError(MessageTemplate::kInvalidSimdIndex)); \ | 
| + } | 
| #define CONVERT_SIMD_ARG_HANDLE_THROW(Type, name, index) \ | 
| Handle<Type> name; \ | 
| @@ -217,8 +228,10 @@ RUNTIME_FUNCTION(Runtime_IsSimdValue) { | 
| // Common functions. | 
| -#define GET_NUMERIC_ARG(lane_type, name, index) \ | 
| - CONVERT_NUMBER_ARG_HANDLE_CHECKED(a, index); \ | 
| +#define GET_NUMERIC_ARG(lane_type, name, index) \ | 
| + Handle<Object> a; \ | 
| + ASSIGN_RETURN_FAILURE_ON_EXCEPTION( \ | 
| + isolate, a, Object::ToNumber(args.at<Object>(index))); \ | 
| name = ConvertNumber<lane_type>(a->Number()); | 
| #define GET_BOOLEAN_ARG(lane_type, name, index) \ | 
| @@ -863,6 +876,17 @@ SIMD_FROM_BITS_TYPES(SIMD_FROM_BITS_FUNCTION) | 
| FUNCTION(Int32x4, int32_t, 4) \ | 
| FUNCTION(Uint32x4, uint32_t, 4) | 
| +#define SIMD_COERCE_INDEX(name, index) \ | 
| + Handle<Object> name_object; \ | 
| + ASSIGN_RETURN_FAILURE_ON_EXCEPTION( \ | 
| + isolate, name_object, \ | 
| + Object::ToLength(isolate, args.at<Object>(index))); \ | 
| + if (!name_object->IsNumber()) { \ | 
| 
 
bbudge
2016/05/11 18:33:16
Same comment as above.
 
gdeepti
2016/05/17 14:59:41
Done.
 
 | 
| + THROW_NEW_ERROR_RETURN_FAILURE( \ | 
| + isolate, NewTypeError(MessageTemplate::kInvalidSimdOperation)); \ | 
| + } \ | 
| + uint32_t name; \ | 
| + name = name_object->Number(); | 
| // Common Load and Store Functions | 
| @@ -870,30 +894,36 @@ SIMD_FROM_BITS_TYPES(SIMD_FROM_BITS_FUNCTION) | 
| static const int kLaneCount = lane_count; \ | 
| DCHECK(args.length() == 2); \ | 
| CONVERT_SIMD_ARG_HANDLE_THROW(JSTypedArray, tarray, 0); \ | 
| - CONVERT_INT32_ARG_CHECKED(index, 1) \ | 
| + SIMD_COERCE_INDEX(lane, 1); \ | 
| 
 
bbudge
2016/05/11 18:33:16
s/lane/index
 
gdeepti
2016/05/17 14:59:41
Done.
 
 | 
| size_t bpe = tarray->element_size(); \ | 
| uint32_t bytes = count * sizeof(lane_type); \ | 
| size_t byte_length = NumberToSize(isolate, tarray->byte_length()); \ | 
| - RUNTIME_ASSERT(index >= 0 && index * bpe + bytes <= byte_length); \ | 
| + Handle<type> result; \ | 
| + if (lane < 0 || byte_length < lane * bpe + bytes) { \ | 
| + THROW_NEW_ERROR_RETURN_FAILURE( \ | 
| + isolate, NewRangeError(MessageTemplate::kInvalidSimdIndex)); \ | 
| + } \ | 
| size_t tarray_offset = NumberToSize(isolate, tarray->byte_offset()); \ | 
| uint8_t* tarray_base = \ | 
| static_cast<uint8_t*>(tarray->GetBuffer()->backing_store()) + \ | 
| tarray_offset; \ | 
| lane_type lanes[kLaneCount] = {0}; \ | 
| - memcpy(lanes, tarray_base + index * bpe, bytes); \ | 
| - Handle<type> result = isolate->factory()->New##type(lanes); | 
| - | 
| + memcpy(lanes, tarray_base + lane * bpe, bytes); \ | 
| + result = isolate->factory()->New##type(lanes); | 
| #define SIMD_STORE(type, lane_type, lane_count, count, a) \ | 
| static const int kLaneCount = lane_count; \ | 
| DCHECK(args.length() == 3); \ | 
| CONVERT_SIMD_ARG_HANDLE_THROW(JSTypedArray, tarray, 0); \ | 
| CONVERT_SIMD_ARG_HANDLE_THROW(type, a, 2); \ | 
| - CONVERT_INT32_ARG_CHECKED(index, 1) \ | 
| + SIMD_COERCE_INDEX(lane, 1); \ | 
| size_t bpe = tarray->element_size(); \ | 
| uint32_t bytes = count * sizeof(lane_type); \ | 
| size_t byte_length = NumberToSize(isolate, tarray->byte_length()); \ | 
| - RUNTIME_ASSERT(index >= 0 && index * bpe + bytes <= byte_length); \ | 
| + if (lane < 0 || byte_length < lane * bpe + bytes) { \ | 
| + THROW_NEW_ERROR_RETURN_FAILURE( \ | 
| + isolate, NewRangeError(MessageTemplate::kInvalidSimdIndex)); \ | 
| + } \ | 
| size_t tarray_offset = NumberToSize(isolate, tarray->byte_offset()); \ | 
| uint8_t* tarray_base = \ | 
| static_cast<uint8_t*>(tarray->GetBuffer()->backing_store()) + \ | 
| @@ -902,8 +932,7 @@ SIMD_FROM_BITS_TYPES(SIMD_FROM_BITS_FUNCTION) | 
| for (int i = 0; i < kLaneCount; i++) { \ | 
| lanes[i] = a->get_lane(i); \ | 
| } \ | 
| - memcpy(tarray_base + index * bpe, lanes, bytes); | 
| - | 
| + memcpy(tarray_base + lane * bpe, lanes, bytes); | 
| #define SIMD_LOAD_FUNCTION(type, lane_type, lane_count) \ | 
| RUNTIME_FUNCTION(Runtime_##type##Load) { \ |