d412cade2a
Due to speculative optimizations, the compiler can run into situations where it's asked perform impossible operations, like loading a tagged element as a float64 instead. All of this is guaranteed to be in dead code (unless there's a bug), but leads to confusion and violates assumptions in the compiler (that make perfect sense for code that is not dead). So teach LoadElimination not to mix up element accesses with incompatible representations. BUG=chromium:719479 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2866233002 Cr-Commit-Position: refs/heads/master@{#45185}
25 lines
527 B
JavaScript
25 lines
527 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function baz(a, b) {
|
|
for (var i = 0; i < a.length; i++) {
|
|
if (a[i], b[i]) return false;
|
|
}
|
|
}
|
|
function bar(expected, found) {
|
|
if (!baz(found, expected)) {
|
|
}
|
|
};
|
|
bar([{}, 6, NaN], [1.8, , NaN]);
|
|
function foo() {
|
|
var a = [1,2,3,4];
|
|
bar(a.length, a.length);
|
|
}
|
|
foo();
|
|
foo();
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|