AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Properly type the OrderedHashTableHealIndex builtin result.

Browse Source 
This unblocks the checks in the SimplifiedLowering that whenever we
store something as TaggedSigned, the input type should at least be
Type::SignedSmall.

Bug: chromium:791245
Change-Id: Ice6e55c2c6584c0ff60c1e033ba755c8863af32a
Reviewed-on: https://chromium-review.googlesource.com/808104
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49856}
This commit is contained in:
Benedikt Meurer 2017-12-05 10:10:35 +01:00 committed by Commit Bot
parent e5a1993bff
commit 3ef6e45ee3
3 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/compiler/js-builtin-reducer.cc
View File

@ -1451,6 +1451,7 @@ Reduction JSBuiltinReducer::ReduceCollectionIteratorNext(
index = effect = graph()->NewNode(
common()->Call(desc), jsgraph()->HeapConstant(callable.code()), table,
index, jsgraph()->NoContextConstant(), effect);
NodeProperties::SetType(index, type_cache_.kFixedArrayLengthType);
// Update the {index} and {table} on the {receiver}.
effect = graph()->NewNode(

18
test/mjsunit/regress/regress-crbug-791245-1.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
const s = new Map;
function foo(s) {
const i = s[Symbol.iterator]();
i.next();
return i;
}
console.log(foo(s));
console.log(foo(s));
%OptimizeFunctionOnNextCall(foo);
console.log(foo(s));

18
test/mjsunit/regress/regress-crbug-791245-2.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
const s = new Set;
function foo(s) {
const i = s[Symbol.iterator]();
i.next();
return i;
}
console.log(foo(s));
console.log(foo(s));
%OptimizeFunctionOnNextCall(foo);
console.log(foo(s));