diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc index 95c150f317..73db511256 100644 --- a/src/compiler/js-native-context-specialization.cc +++ b/src/compiler/js-native-context-specialization.cc @@ -2183,8 +2183,8 @@ JSNativeContextSpecialization::BuildElementAccess( value); } else { // Bailout if we see the hole. - effect = graph()->NewNode(simplified()->CheckNotTaggedHole(), value, - effect, control); + value = effect = graph()->NewNode(simplified()->CheckNotTaggedHole(), + value, effect, control); } } else if (elements_kind == FAST_HOLEY_DOUBLE_ELEMENTS) { // Perform the hole check on the result. diff --git a/src/compiler/opcodes.h b/src/compiler/opcodes.h index b543ffbc66..6ad1f6ec3a 100644 --- a/src/compiler/opcodes.h +++ b/src/compiler/opcodes.h @@ -225,8 +225,7 @@ V(CheckedTaggedToFloat64) \ V(CheckedTaggedToTaggedSigned) \ V(CheckedTaggedToTaggedPointer) \ - V(CheckTaggedHole) \ - V(CheckNotTaggedHole) + V(CheckTaggedHole) #define SIMPLIFIED_COMPARE_BINOP_LIST(V) \ V(NumberEqual) \ @@ -331,6 +330,7 @@ V(CheckSmi) \ V(CheckHeapObject) \ V(CheckFloat64Hole) \ + V(CheckNotTaggedHole) \ V(ConvertTaggedHoleToUndefined) \ V(Allocate) \ V(LoadField) \ diff --git a/src/compiler/simplified-operator.cc b/src/compiler/simplified-operator.cc index 9c11aa7eb5..2720b62d13 100644 --- a/src/compiler/simplified-operator.cc +++ b/src/compiler/simplified-operator.cc @@ -527,7 +527,7 @@ UnicodeEncoding UnicodeEncodingOf(const Operator* op) { V(CheckSeqString, 1, 1) \ V(CheckSymbol, 1, 1) \ V(CheckTaggedHole, 1, 0) \ - V(CheckNotTaggedHole, 1, 0) \ + V(CheckNotTaggedHole, 1, 1) \ V(CheckedInt32Add, 2, 1) \ V(CheckedInt32Sub, 2, 1) \ V(CheckedInt32Div, 2, 1) \ diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc index 580912cc40..e5f7ff5a4b 100644 --- a/src/compiler/typer.cc +++ b/src/compiler/typer.cc @@ -1871,6 +1871,12 @@ Type* Typer::Visitor::TypeCheckFloat64Hole(Node* node) { return typer_->operation_typer_.CheckFloat64Hole(Operand(node, 0)); } +Type* Typer::Visitor::TypeCheckNotTaggedHole(Node* node) { + Type* type = Operand(node, 0); + type = Type::Intersect(type, Type::NonInternal(), zone()); + return type; +} + Type* Typer::Visitor::TypeConvertTaggedHoleToUndefined(Node* node) { Type* type = Operand(node, 0); if (type->Maybe(Type::Hole())) { diff --git a/src/compiler/verifier.cc b/src/compiler/verifier.cc index 854feaeb94..beb2260cad 100644 --- a/src/compiler/verifier.cc +++ b/src/compiler/verifier.cc @@ -1231,6 +1231,7 @@ void Verifier::Visitor::Check(Node* node) { break; case IrOpcode::kCheckNotTaggedHole: CheckValueInputIs(node, 0, Type::Any()); + CheckTypeIs(node, Type::NonInternal()); break; case IrOpcode::kConvertTaggedHoleToUndefined: CheckValueInputIs(node, 0, Type::Any()); diff --git a/test/mjsunit/regress/regress-730254.js b/test/mjsunit/regress/regress-730254.js new file mode 100644 index 0000000000..fc8af55c58 --- /dev/null +++ b/test/mjsunit/regress/regress-730254.js @@ -0,0 +1,37 @@ +// Copyright 2010 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Flags: --allow-natives-syntax --opt --turbo --no-always-opt + +var __v_0 = {}; +__v_0 = new Map(); +function __f_0() { + __v_0[0] --; +} +__f_0(); +%OptimizeFunctionOnNextCall(__f_0); +__f_0();