Index: src/ia32/lithium-codegen-ia32.cc |
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc |
index f3bcf1abc3fc1974af2b7bd55a8aeec35aec8269..1e744a64e101c7482cc7d622d4a4e3d6661cc18d 100644 |
--- a/src/ia32/lithium-codegen-ia32.cc |
+++ b/src/ia32/lithium-codegen-ia32.cc |
@@ -2705,6 +2705,10 @@ Operand LCodeGen::BuildFastArrayOperand( |
uint32_t additional_index) { |
Register elements_pointer_reg = ToRegister(elements_pointer); |
int shift_size = ElementsKindToShiftSize(elements_kind); |
+ // Even though the HLoad/StoreKeyedFastElement instructions force the input |
+ // representation for the key to be an integer, the input gets replaced during |
+ // bound check elimination with the index argument to the bounds check, which |
+ // can be tagged, so that case must be handled here, too. |
if (key_representation.IsTagged() && (shift_size >= 1)) { |
shift_size -= kSmiTagSize; |
} |
@@ -3681,8 +3685,14 @@ void LCodeGen::DoStoreNamedGeneric(LStoreNamedGeneric* instr) { |
void LCodeGen::DoBoundsCheck(LBoundsCheck* instr) { |
if (instr->index()->IsConstantOperand()) { |
- __ cmp(ToOperand(instr->length()), |
- Immediate(ToInteger32(LConstantOperand::cast(instr->index())))); |
+ int constant_index = |
+ ToInteger32(LConstantOperand::cast(instr->index())); |
+ if (instr->hydrogen()->length()->representation().IsTagged()) { |
+ __ cmp(ToOperand(instr->length()), |
+ Immediate(Smi::FromInt(constant_index))); |
+ } else { |
+ __ cmp(ToOperand(instr->length()), Immediate(constant_index)); |
+ } |
DeoptimizeIf(below_equal, instr->environment()); |
} else { |
__ cmp(ToRegister(instr->index()), ToOperand(instr->length())); |