diff --git a/src/compiler/constant-folding-reducer.cc b/src/compiler/constant-folding-reducer.cc index b1f458ac8b..9649dbda08 100644 --- a/src/compiler/constant-folding-reducer.cc +++ b/src/compiler/constant-folding-reducer.cc @@ -43,18 +43,16 @@ Node* TryGetConstant(JSGraph* jsgraph, Node* node) { bool IsAlreadyBeingFolded(Node* node) { DCHECK(FLAG_assert_types); if (node->opcode() == IrOpcode::kFoldConstant) return true; - bool found = false; for (Edge edge : node->use_edges()) { - if (!NodeProperties::IsValueEdge(edge)) continue; - if (edge.from()->opcode() == IrOpcode::kFoldConstant) { - DCHECK(!found); - found = true; -#ifndef ENABLE_SLOW_DCHECKS - break; -#endif + if (NodeProperties::IsValueEdge(edge) && + edge.from()->opcode() == IrOpcode::kFoldConstant) { + // Note: {node} may have gained new value uses since the time it was + // "constant-folded", and theses uses should ideally be rewritten as well. + // For simplicity, we ignore them here. + return true; } } - return found; + return false; } } // namespace diff --git a/test/mjsunit/compiler/regress-1062916.js b/test/mjsunit/compiler/regress-1062916.js new file mode 100644 index 0000000000..f7064571ea --- /dev/null +++ b/test/mjsunit/compiler/regress-1062916.js @@ -0,0 +1,20 @@ +// Copyright 2020 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --no-analyze-environment-liveness --no-use-ic + +function foo(x) { + var a = []; + for (var k1 in x) { + for (var k2 in x) { + a.k2; + } + } + return a.join(); +} + +%PrepareFunctionForOptimization(foo); +foo({p: 42}); +%OptimizeFunctionOnNextCall(foo); +foo();