Commit 576a46f5 authored by ishell's avatar ishell Committed by Commit bot

[crankshaft] Properly handle OOB string accesses.

BUG=chromium:665793

Review-Url: https://codereview.chromium.org/2589823003
Cr-Commit-Position: refs/heads/master@{#41842}
parent 119db080
......@@ -7508,6 +7508,12 @@ void HOptimizedGraphBuilder::BuildLoad(Property* expr,
HValue* string = Pop();
HInstruction* char_code = BuildStringCharCodeAt(string, index);
AddInstruction(char_code);
if (char_code->IsConstant()) {
HConstant* c_code = HConstant::cast(char_code);
if (c_code->HasNumberValue() && std::isnan(c_code->DoubleValue())) {
Add<HDeoptimize>(DeoptimizeReason::kOutOfBounds, Deoptimizer::EAGER);
}
}
instr = NewUncasted<HStringCharFromCode>(char_code);
} else if (expr->key()->IsPropertyName()) {
......
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
return 'x'[1];
}
assertEquals(undefined, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(undefined, foo());
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment