53c1525df2
Extend the flag parameter with a bit that decides if the input should be converted (-0 to 0, and a string to the array index it represents). Instruct redundancy elimination to never replace x with CheckBounds(x) when this CheckBounds is of the converting kind. Bug: chromium:1070892, chromium:1071743 Change-Id: I3125a6e267d56dae6bf6cb2f5f52d27ef65d7c79 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157365 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#67408}
33 lines
763 B
JavaScript
33 lines
763 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
|
|
function foo(v) {
|
|
let x = Math.floor(v);
|
|
Number.prototype[v] = 42;
|
|
return x + Math.floor(v);
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
assertSame(foo(-0), -0);
|
|
assertSame(foo(-0), -0);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertSame(foo(-0), -0);
|
|
|
|
|
|
function bar(v) {
|
|
v = v ? (v|0) : -0; // v has now type Integral32OrMinusZero.
|
|
let x = Math.floor(v);
|
|
Number.prototype[v] = 42;
|
|
return x + Math.floor(v);
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(bar);
|
|
assertSame(2, bar(1));
|
|
assertSame(2, bar(1));
|
|
%OptimizeFunctionOnNextCall(bar);
|
|
assertSame(-0, bar(-0));
|