diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc index 75de8ecc42..be599beaca 100644 --- a/src/compiler/simplified-lowering.cc +++ b/src/compiler/simplified-lowering.cc @@ -3943,10 +3943,15 @@ class RepresentationSelector { VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged, inputType); if (lower()) { - CHECK_IMPLIES(!FLAG_fuzzing, inputType.CanBeAsserted()); if (inputType.CanBeAsserted()) { ChangeOp(node, simplified()->AssertType(inputType)); } else { + if (!FLAG_fuzzing) { +#ifdef DEBUG + inputType.Print(); +#endif + FATAL("%%VerifyType: unsupported type"); + } DeferReplacement(node, node->InputAt(0)); } } diff --git a/test/mjsunit/compiler/verify-type.js b/test/mjsunit/compiler/verify-type.js new file mode 100644 index 0000000000..96df39b2ab --- /dev/null +++ b/test/mjsunit/compiler/verify-type.js @@ -0,0 +1,14 @@ +// Copyright 2021 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --no-stress-opt + +function foo(x) { + return %VerifyType(x * x); +} + +%PrepareFunctionForOptimization(foo); +foo(42); +%OptimizeFunctionOnNextCall(foo); +foo(42);