AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Use CheckIf instead of DeoptimizeIf to fix the framestate

Browse Source 
Bug: chromium:1399695
Change-Id: Id2aae902d1ce483b4d0a1e4953074a7539cf7058
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092264
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84752}
This commit is contained in:
Toon Verwaest 2022-12-09 12:21:46 +01:00 committed by V8 LUCI CQ
parent 1d733b97a2
commit f3c20276ed
2 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/compiler/js-native-context-specialization.cc
View File

@ -2902,11 +2902,10 @@ JSNativeContextSpecialization::BuildPropertyStore(
if (access_info.IsFastDataConstant() && access_mode == AccessMode::kStore &&
!access_info.HasTransitionMap()) {
Node* deoptimize = graph()->NewNode(
common()->DeoptimizeIf(DeoptimizeReason::kStoreToConstant,
FeedbackSource()),
jsgraph()->TrueConstant(), frame_state, effect, control);
simplified()->CheckIf(DeoptimizeReason::kStoreToConstant),
jsgraph()->FalseConstant(), effect, control);
return ValueEffectControl(jsgraph()->UndefinedConstant(), deoptimize,
deoptimize);
control);
}
FieldAccess field_access = {
kTaggedBase,

13
test/mjsunit/regress/regress-crbug-1399695.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function __f_3() {
isNaN.prototype = 14;
}
%PrepareFunctionForOptimization(__f_3);
__f_3();
%OptimizeFunctionOnNextCall(__f_3);
__f_3();