HGraphBuilder::BuildJSObjectCheck: Tighten instance type comparison

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <algorithm>
 
 #include "src/v8.h"
 
@@ skipping 1413 matching lines @@
   HObjectAccess access(HObjectAccess::ForMapInstanceTypeAndBitField());
   HValue* instance_type_and_bit_field =
       Add<HLoadNamedField>(map, static_cast<HValue*>(NULL), access);
 
   HValue* mask = Add<HConstant>(0x00FF | (bit_field_mask << 8));
   HValue* and_result = AddUncasted<HBitwise>(Token::BIT_AND,
                                              instance_type_and_bit_field,
                                              mask);
   HValue* sub_result = AddUncasted<HSub>(and_result,
                                          Add<HConstant>(JS_OBJECT_TYPE));
-  Add<HBoundsCheck>(sub_result, Add<HConstant>(0x100 - JS_OBJECT_TYPE));
+  Add<HBoundsCheck>(sub_result,
+                    Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
 }
 
 
 void HGraphBuilder::BuildKeyedIndexCheck(HValue* key,
                                          HIfContinuation* join_continuation) {
   // The sometimes unintuitively backward ordering of the ifs below is
   // convoluted, but necessary.  All of the paths must guarantee that the
   // if-true of the continuation returns a smi element index and the if-false of
   // the continuation returns either a symbol or a unique string key. All other
   // object types cause a deopt to fall back to the runtime.
@@ skipping 10931 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal