a58d7907ea
When lowering JSToLength, we cannot just smash arbitrary bounds on the Select nodes, as that will confuse the representation selection later. Instead properly rename the input using NumberMax and NumberMin. R=jarin@chromium.org BUG=chromium:657478 Review-Url: https://codereview.chromium.org/2440333002 Cr-Commit-Position: refs/heads/master@{#40519}
14 lines
380 B
JavaScript
14 lines
380 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(o) { return %_ToLength(o.length); }
|
|
|
|
foo(new Array(4));
|
|
foo(new Array(Math.pow(2, 32) - 1));
|
|
foo({length: 10});
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo({length: 10});
|