a758c19761
We need to rename the receiver on CheckHeapObject, because we don't canonicalize numbers in SignedSmall range, and thus we the representation selection can hand out TaggedSigned values for receiver uses, even though we checked for TaggedPointerness first. Note that this is rather hacky and just intended to fix the bug ASAP. We need to think about how to deal with representations in earlier compilation stages. BUG=chromium:662410 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2485563002 Cr-Commit-Position: refs/heads/master@{#40792}
22 lines
377 B
JavaScript
22 lines
377 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function g(v) { return v.constructor; }
|
|
|
|
g({});
|
|
g({});
|
|
|
|
function f() {
|
|
var i = 0;
|
|
do {
|
|
i = i + 1;
|
|
g(i);
|
|
} while (i < 1);
|
|
}
|
|
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f();
|