AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Don't eliminate unused CheckFloat64Hole.

Browse Source 
We cannot eliminate unused CheckFloat64Hole nodes, since loading from a
holey array can have side-effects, i.e. triggering getters in the
prototype chain.

R=mvstanton@chromium.org
BUG=chromium:686737

Review-Url: https://codereview.chromium.org/2665123002
Cr-Commit-Position: refs/heads/master@{#42806}
This commit is contained in:
bmeurer 2017-01-31 00:30:55 -08:00 committed by Commit bot
parent a14f228188
commit b8df954993
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/compiler/simplified-lowering.cc
View File

@ -2555,7 +2555,6 @@ class RepresentationSelector {
return;
}
case IrOpcode::kCheckFloat64Hole: {
if (truncation.IsUnused()) return VisitUnused(node);
CheckFloat64HoleMode mode = CheckFloat64HoleModeOf(node->op());
ProcessInput(node, 0, UseInfo::TruncatingFloat64());
ProcessRemainingInputs(node, 1);

13
test/mjsunit/regress/regress-crbug-686737.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
Object.prototype.__defineGetter__(0, () => { throw Error() });
var a = [,0.1];
function foo(i) { a[i]; }
foo(1);
foo(1);
%OptimizeFunctionOnNextCall(foo);
assertThrows(() => foo(0), Error);