diff --git a/src/compiler/escape-analysis.cc b/src/compiler/escape-analysis.cc index 4b773136a9..984c513396 100644 --- a/src/compiler/escape-analysis.cc +++ b/src/compiler/escape-analysis.cc @@ -623,9 +623,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current, break; } case IrOpcode::kTypeGuard: { - // The type-guard is re-introduced in the final reducer if the types - // don't match. - current->SetReplacement(current->ValueInput(0)); + current->SetVirtualObject(current->ValueInput(0)); break; } case IrOpcode::kReferenceEqual: { diff --git a/test/mjsunit/compiler/escape-analysis-18.js b/test/mjsunit/compiler/escape-analysis-18.js new file mode 100644 index 0000000000..f2ff08299f --- /dev/null +++ b/test/mjsunit/compiler/escape-analysis-18.js @@ -0,0 +1,23 @@ +// Copyright 2017 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --turbo-escape + +function bar(arr) { + var x = 0; + arr.forEach(function(el) { + x = el; + }); + return x; +} + +function foo(array) { + return bar(array); +} + +let array = [,.5,]; +foo(array); +foo(array); +%OptimizeFunctionOnNextCall(foo); +foo(array);