Index: src/compiler/simplified-lowering.cc |
diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc |
index e4ab10f564989aac2eb12e41af7f30d49233ddce..e017f1d2e401de0e193d9b32fb6654a003728a07 100644 |
--- a/src/compiler/simplified-lowering.cc |
+++ b/src/compiler/simplified-lowering.cc |
@@ -2295,13 +2295,19 @@ class RepresentationSelector { |
case IrOpcode::kCheckBounds: { |
Type* index_type = TypeOf(node->InputAt(0)); |
Type* length_type = TypeOf(node->InputAt(1)); |
- if (index_type->Is(Type::Unsigned32())) { |
+ if (index_type->Is(Type::Integral32OrMinusZero())) { |
+ // Map -0 to 0, and the values in the [-2^31,-1] range to the |
+ // [2^31,2^32-1] range, which will be considered out-of-bounds |
+ // as well, because the {length_type} is limited to Unsigned31. |
VisitBinop(node, UseInfo::TruncatingWord32(), |
MachineRepresentation::kWord32); |
- if (lower() && index_type->Max() < length_type->Min()) { |
- // The bounds check is redundant if we already know that |
- // the index is within the bounds of [0.0, length[. |
- DeferReplacement(node, node->InputAt(0)); |
+ if (lower()) { |
+ if (index_type->Min() >= 0.0 && |
+ index_type->Max() < length_type->Min()) { |
+ // The bounds check is redundant if we already know that |
+ // the index is within the bounds of [0.0, length[. |
+ DeferReplacement(node, node->InputAt(0)); |
+ } |
} |
} else { |
VisitBinop(node, UseInfo::CheckedSigned32AsWord32(kIdentifyZeros), |