[turbofan] Skip bounds checks for positive indices only.

src/compiler/simplified-operator-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/generic-node-inl.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/simplified-operator-reducer.h"
 
@@ skipping 88 matching lines @@
       if (m.HasValue()) return ReplaceNumber(FastUI2D(m.Value()));
       break;
     }
     case IrOpcode::kLoadElement: {
       ElementAccess access = ElementAccessOf(node->op());
       if (access.bounds_check == kTypedArrayBoundsCheck) {
         NumericValueMatcher mkey(node->InputAt(1));
         NumericValueMatcher mlength(node->InputAt(2));
         if (mkey.HasValue() && mlength.HasValue()) {
           // Skip the typed array bounds check if key and length are constant.
-          if (mkey.Value() < mlength.Value()) {
+          if (mkey.Value() >= 0 && mkey.Value() < mlength.Value()) {
             access.bounds_check = kNoBoundsCheck;
             node->set_op(simplified()->LoadElement(access));
             return Changed(node);
           }
         }
       }
       break;
     }
     case IrOpcode::kStoreElement: {
       ElementAccess access = ElementAccessOf(node->op());
       if (access.bounds_check == kTypedArrayBoundsCheck) {
         NumericValueMatcher mkey(node->InputAt(1));
         NumericValueMatcher mlength(node->InputAt(2));
         if (mkey.HasValue() && mlength.HasValue()) {
           // Skip the typed array bounds check if key and length are constant.
-          if (mkey.Value() < mlength.Value()) {
+          if (mkey.Value() >= 0 && mkey.Value() < mlength.Value()) {
             access.bounds_check = kNoBoundsCheck;
             node->set_op(simplified()->StoreElement(access));
             return Changed(node);
           }
         }
       }
       break;
     }
     default:
       break;
@@ skipping 38 matching lines @@
 }
 
 
 MachineOperatorBuilder* SimplifiedOperatorReducer::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8