AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix an assertion in representation selection for BooleanNot.

Browse Source 
BUG=chromium:736567

Review-Url: https://codereview.chromium.org/2962503002
Cr-Commit-Position: refs/heads/master@{#46216}
This commit is contained in:
jarin 2017-06-26 06:49:06 -07:00 committed by Commit Bot
parent 969ad75256
commit bdf1b0a84a
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/simplified-lowering.cc
View File

@ -1569,8 +1569,7 @@ class RepresentationSelector {
node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
} else {
DCHECK_EQ(MachineRepresentation::kNone,
input_info->representation());
DCHECK(!TypeOf(node->InputAt(0))->IsInhabited());
DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
}
} else {

20
test/mjsunit/compiler/regress-736567.js Normal file
View File

@ -0,0 +1,20 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(b, x) {
var o = b ? { a : 1 } : undefined;
return o.a + !(x & 1);
}
f(1);
function g() {
f(0, "s");
}
assertThrows(g);
%OptimizeFunctionOnNextCall(g);
assertThrows(g);