0d5588dc2c
Math fast-path cannot drop arguments because their side-effects must be preserved. For example, Math.imul(x) dropped x entirely, because if x is convertible to an integer, the result is 0. This, however, is not OK because converting x to an integer might throw. Bug: chromium:818070, v8:7250, v8:7240 Change-Id: I8363e6dcd3fc78c879395aacb636d5782c3b023e Reviewed-on: https://chromium-review.googlesource.com/948523 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51736}
36 lines
715 B
JavaScript
36 lines
715 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --opt --no-always-opt --allow-natives-syntax
|
|
|
|
function f(a) {
|
|
Math.imul(a);
|
|
}
|
|
|
|
x = { [Symbol.toPrimitive]: () => FAIL };
|
|
f(1);
|
|
f(1);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertThrows(() => f(x), ReferenceError);
|
|
|
|
function f(a) {
|
|
Math.pow(a);
|
|
}
|
|
|
|
x = { [Symbol.toPrimitive]: () => FAIL };
|
|
f(1);
|
|
f(1);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertThrows(() => f(x), ReferenceError);
|
|
|
|
function f(a) {
|
|
Math.atan2(a);
|
|
}
|
|
|
|
x = { [Symbol.toPrimitive]: () => FAIL };
|
|
f(1);
|
|
f(1);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertThrows(() => f(x), ReferenceError);
|