BCE: don't assume a bounds check always gets a HArrayLength.
Deoptimizations may change it to a HPhi.
bug:22056703
Change-Id: I8995209438764dac496ed856782b147ba21f93e5
diff --git a/compiler/optimizing/bounds_check_elimination.cc b/compiler/optimizing/bounds_check_elimination.cc
index 900dabe..7fe9fb2 100644
--- a/compiler/optimizing/bounds_check_elimination.cc
+++ b/compiler/optimizing/bounds_check_elimination.cc
@@ -1388,7 +1388,7 @@
if (array_length->IsPhi()) {
// Input 1 of the phi contains the real array.length once the loop body is
// entered. That value will be used for bound analysis. The graph is still
- // strickly in SSA form.
+ // strictly in SSA form.
array_length = array_length->AsPhi()->InputAt(1)->AsArrayLength();
}
@@ -1780,7 +1780,13 @@
it != first_constant_index_bounds_check_map_.end();
++it) {
HBoundsCheck* bounds_check = it->second;
- HArrayLength* array_length = bounds_check->InputAt(1)->AsArrayLength();
+ HInstruction* array_length = bounds_check->InputAt(1);
+ if (!array_length->IsArrayLength()) {
+ // Prior deoptimizations may have changed the array length to a phi.
+ // TODO(mingyao): propagate the range to the phi?
+ DCHECK(array_length->IsPhi()) << array_length->DebugName();
+ continue;
+ }
HIntConstant* lower_bound_const_instr = nullptr;
int32_t lower_bound_const = INT_MIN;
size_t counter = 0;