AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix typer bug in Array.p.reduce[Right]

Browse Source 
When finding the initial element in A.p.reduce[Right], we did
exclude holes, but did not reflect this is the type, which still
included the hole. This CL inserts a TypeGuard to ensure that
Turbofan knows the initial element is never the hole.

Bug: chromium:804837
Change-Id: Ia118ddafb8e16dd5c02559fa23216c9b139dd59a
Reviewed-on: https://chromium-review.googlesource.com/880967
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50814}
This commit is contained in:
Sigurd Schneider 2018-01-23 14:53:31 +01:00 committed by Commit Bot
parent b71133245c
commit a9796a1d27
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/js-call-reducer.cc
View File

@ -1126,6 +1126,9 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
Node* is_hole = graph()->NewNode(common()->IfTrue(), hole_branch);
WireInLoopEnd(loop, eloop, vloop, next_k, is_hole, effect);
// We did the hole-check, so exclude hole from the type.
cur = effect = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
cur, effect, control);
k = next_k;
}

14
test/mjsunit/regress/regress-804837.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --opt --allow-natives-syntax
var __v_25662 = [, 1.8];
function __f_6214(__v_25668) {
__v_25662.reduce(() => {1});
}
__f_6214();
__f_6214();
%OptimizeFunctionOnNextCall(__f_6214);
__f_6214();