[turbofan] CheckBounds cannot be used within asm.js.

Also properly deal with constant indices for String element access in
the JSNativeContextSpecialization.

BUG=chromium:661949
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2474013002
Cr-Commit-Position: refs/heads/master@{#40723}

src/compiler/js-native-context-specialization.cc

@@ -688,19 +688,29 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
       // Strings are immutable in JavaScript.
       if (access_mode == AccessMode::kStore) return NoChange();
 
-      // Ensure that {index} is less than {receiver} length.
-      Node* length = jsgraph()->Constant(string->length());
-      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
-                                        length, effect, control);
-
-      // Load the character from the {receiver}.
-      value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
-                               index, control);
-
-      // Return it as a single character string.
-      value = graph()->NewNode(simplified()->StringFromCharCode(), value);
-      ReplaceWithValue(node, value, effect, control);
-      return Replace(value);
+      // Properly deal with constant {index}.
+      NumberMatcher mindex(index);
+      if (mindex.IsInteger() && mindex.IsInRange(0.0, string->length() - 1)) {
+        // Constant-fold the {index} access to {string}.
+        Node* value =
+            jsgraph()->Constant(string->Get(static_cast<int>(mindex.Value())));
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      } else if (flags() & kDeoptimizationEnabled) {
+        // Ensure that {index} is less than {receiver} length.
+        Node* length = jsgraph()->Constant(string->length());
+        index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                          length, effect, control);
+
+        // Load the character from the {receiver}.
+        value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
+                                 index, control);
+
+        // Return it as a single character string.
+        value = graph()->NewNode(simplified()->StringFromCharCode(), value);
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      }
     }
   }
 

src/compiler/node-matchers.h

@@ -167,6 +167,9 @@ struct FloatMatcher final : public ValueMatcher<T, kOpcode> {
   bool IsNormal() const {
     return this->HasValue() && std::isnormal(this->Value());
   }
+  bool IsInteger() const {
+    return this->HasValue() && std::nearbyint(this->Value()) == this->Value();
+  }
   bool IsPositiveOrNegativePowerOf2() const {
     if (!this->HasValue() || (this->Value() == 0.0)) {
       return false;

test/mjsunit/regress/regress-crbug-661949.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+  'use asm';
+  function foo() { ''[0]; }
+  return foo;
+})();
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();