Check that constant is an integer before getting its value in HGraphBuilder::MatchRotateRight.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 8917 matching lines @@
     const HConstant* c1 = HConstant::cast(sa);
     const HConstant* c2 = HConstant::cast(const32_minus_sa);
     return c1->HasInteger32Value() && c2->HasInteger32Value() &&
         (c1->Integer32Value() + c2->Integer32Value() == 32);
   }
   if (!const32_minus_sa->IsSub()) return false;
   HSub* sub = HSub::cast(const32_minus_sa);
   if (sa != sub->right()) return false;
   HValue* const32 = sub->left();
   if (!const32->IsConstant() ||
+      !HConstant::cast(const32)->HasInteger32Value() ||
       HConstant::cast(const32)->Integer32Value() != 32) {

[Sven Panne, 2014/03/13 09:36:40]

Simplify this brain teaser to

return sub->left()->EqualsInteger32Constant(32)) && sub->right() == sa;

     return false;
   }
   return (sub->right() == sa);
 }
 
 
 // Checks if the left and the right are shift instructions with the oposite
 // directions that can be replaced by one rotate right instruction or not.
 // Returns the operand and the shift amount for the rotate instruction in the
 // former case.
@@ skipping 2349 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal