AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Update Node type in JSTypedLowering::ReduceJSToNumeric

Browse Source 
ReduceJSToNumeric() can fail to update the node type after changing
it's operator to JSToNumeric.

BUG=chromium:1158049

Change-Id: Iaabb3676f8ad9563903b81de2e7eecdcc92cbc0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593336
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71771}
This commit is contained in:
Mike Stanton 2020-12-15 17:42:40 +01:00 committed by Commit Bot
parent b68466f4c9
commit 13921eb704
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/js-typed-lowering.cc
View File

@ -1046,6 +1046,9 @@ Reduction JSTypedLowering::ReduceJSToNumeric(Node* node) {
if (input_type.Is(Type::NonBigIntPrimitive())) {
// ToNumeric(x:primitive\bigint) => ToNumber(x)
NodeProperties::ChangeOp(node, javascript()->ToNumber());
Type node_type = NodeProperties::GetType(node);
NodeProperties::SetType(
node, Type::Intersect(node_type, Type::Number(), graph()->zone()));
return Changed(node).FollowedBy(ReduceJSToNumber(node));
}
return NoChange();

16
test/mjsunit/compiler/regress-1158049.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const v2 = Symbol.unscopables;
function v6(v7,v8,v9,v10) {
try {
let v11 = eval && v2;
const v12 = v11++;
} catch(v13) {}
}
for (let v17 = 1; v17 < 10000; v17++) {
const v18 = v6();
}