3118f47395
Ensure we only lower SpeculativeNumberBinops to a pure operator for non-string plain primitives. Previously we could lower if a value might be the-hole, however this would fail a CHECK in ConvertInputsToNumber which expects a plain primitive. BUG=chromium:772420 Change-Id: I0c755d10db7afd9cabfb638eca5662d70dfc8d51 Reviewed-on: https://chromium-review.googlesource.com/715717 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#48649}
29 lines
817 B
JavaScript
29 lines
817 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(arg) {
|
|
var value;
|
|
// None of the branches of this switch are ever taken, but
|
|
// the sequence means value could be the hole.
|
|
switch (arg) {
|
|
case 1:
|
|
let let_var = 1;
|
|
case 2:
|
|
value = let_var;
|
|
}
|
|
// Speculative number binop with NumberOrOddball feedback.
|
|
// Shouldn't be optimized to pure operator since value's phi
|
|
// could theoretically be the hole (we would have already thrown a
|
|
// reference error in case 2 above if so, but TF typing still
|
|
// thinks it could be the hole).
|
|
return value * undefined;
|
|
}
|
|
|
|
foo(3);
|
|
foo(3);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo(3);
|