Commit d7ad12df authored by Jakob Kummerow's avatar Jakob Kummerow Committed by Commit Bot

[KeyedLoadIC] Fix negative index handling for TypedArrays

A recent refactoring accidentally disabled the code path that keeps
negative indices for TypedArrays on the fast path.

Change-Id: I89bbb414f54d04f85af77c6d205705906925c61e
Reviewed-on: https://chromium-review.googlesource.com/1164469Reviewed-by: 's avatarAdam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54932}
parent b7ef0e62
......@@ -1150,7 +1150,7 @@ bool ConvertKeyToIndex(Handle<Object> receiver, Handle<Object> key,
// For regular JSReceiver or String receivers, the {key} must be a positive
// array index.
if (receiver->IsJSReceiver() || receiver->IsString()) {
return key->ToArrayIndex(index);
if (key->ToArrayIndex(index)) return true;
}
// For JSTypedArray receivers, we can also support negative keys, which we
// just map into the [2**31, 2**32 - 1] range via a bit_cast. This is valid
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment