[turbofan] CheckBounds cannot be used within asm.js.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 670 matching lines @@
   if (mreceiver.HasValue() && mreceiver.Value()->IsString()) {
     Handle<String> string = Handle<String>::cast(mreceiver.Value());
 
     // We can only assume that the {index} is a valid array index if the IC
     // is in element access mode and not MEGAMORPHIC, otherwise there's no
     // guard for the bounds check below.
     if (nexus.ic_state() != MEGAMORPHIC && nexus.GetKeyType() == ELEMENT) {
       // Strings are immutable in JavaScript.
       if (access_mode == AccessMode::kStore) return NoChange();
 
-      // Ensure that {index} is less than {receiver} length.
-      Node* length = jsgraph()->Constant(string->length());
-      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
-                                        length, effect, control);
+      // Properly deal with constant {index}.
+      NumberMatcher mindex(index);
+      if (mindex.IsInteger() && mindex.IsInRange(0.0, string->length() - 1)) {
+        // Constant-fold the {index} access to {string}.
+        Node* value =
+            jsgraph()->Constant(string->Get(static_cast<int>(mindex.Value())));
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      } else if (flags() & kDeoptimizationEnabled) {
+        // Ensure that {index} is less than {receiver} length.
+        Node* length = jsgraph()->Constant(string->length());
+        index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                          length, effect, control);
 
-      // Load the character from the {receiver}.
-      value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
-                               index, control);
+        // Load the character from the {receiver}.
+        value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
+                                 index, control);
 
-      // Return it as a single character string.
-      value = graph()->NewNode(simplified()->StringFromCharCode(), value);
-      ReplaceWithValue(node, value, effect, control);
-      return Replace(value);
+        // Return it as a single character string.
+        value = graph()->NewNode(simplified()->StringFromCharCode(), value);
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      }
     }
   }
 
   // Check if the {nexus} reports type feedback for the IC.
   if (nexus.IsUninitialized()) {
     if ((flags() & kDeoptimizationEnabled) &&
         (flags() & kBailoutOnUninitialized)) {
       return ReduceSoftDeoptimize(
           node,
           DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
@@ skipping 909 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8