From f7ac95c24fe58cb78c32775fb09264bdf5633b1b Mon Sep 17 00:00:00 2001 From: Tobias Tebbi Date: Fri, 19 May 2017 13:41:45 +0200 Subject: [PATCH] [turbofan] constructor inlining registers new nodes with the GraphReducer Bug: chromium:723802 Change-Id: I8f23d016a5aaf785fcd27cd139a196a148a37069 Reviewed-on: https://chromium-review.googlesource.com/508712 Commit-Queue: Tobias Tebbi Reviewed-by: Michael Starzinger Cr-Commit-Position: refs/heads/master@{#45424} --- src/compiler/graph-reducer.cc | 2 -- src/compiler/js-inlining.cc | 13 ++++++------- 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/src/compiler/graph-reducer.cc b/src/compiler/graph-reducer.cc index 8b85b5a07d..ebc1ff0c99 100644 --- a/src/compiler/graph-reducer.cc +++ b/src/compiler/graph-reducer.cc @@ -244,8 +244,6 @@ void GraphReducer::ReplaceWithValue(Node* node, Node* value, Node* effect, DCHECK_NOT_NULL(control); edge.UpdateTo(control); Revisit(user); - // TODO(jarin) Check that the node cannot throw (otherwise, it - // would have to be connected via IfSuccess/IfException). } } else if (NodeProperties::IsEffectEdge(edge)) { DCHECK_NOT_NULL(effect); diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc index ff1f0a2f10..9b260e3533 100644 --- a/src/compiler/js-inlining.cc +++ b/src/compiler/js-inlining.cc @@ -687,9 +687,8 @@ Reduction JSInliner::ReduceJSCall(Node* node) { result = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2), create, node, merge); - NodeProperties::ReplaceUses(node_success, node_success, node_success, - merge); - // Fix input destroyed by the above {ReplaceUses} call. + ReplaceWithValue(node_success, node_success, node_success, merge); + // Fix input destroyed by the above {ReplaceWithValue} call. NodeProperties::ReplaceControlInput(branch_is_undefined, node_success, 0); } else { @@ -702,7 +701,7 @@ Reduction JSInliner::ReduceJSCall(Node* node) { check, node, create); } receiver = create; // The implicit receiver. - NodeProperties::ReplaceUses(dummy, result); + ReplaceWithValue(dummy, result); } else if (IsDerivedConstructor(shared_info->kind())) { Node* node_success = NodeProperties::FindSuccessfulControlProjection(node); @@ -726,9 +725,9 @@ Reduction JSInliner::ReduceJSCall(Node* node) { NodeProperties::MergeControlToEnd(graph(), common(), branch_is_receiver_false); - NodeProperties::ReplaceUses(node_success, node_success, node_success, - branch_is_receiver_true); - // Fix input destroyed by the above {ReplaceUses} call. + ReplaceWithValue(node_success, node_success, node_success, + branch_is_receiver_true); + // Fix input destroyed by the above {ReplaceWithValue} call. NodeProperties::ReplaceControlInput(branch_is_receiver, node_success, 0); } node->ReplaceInput(1, receiver);