e66a1116fb
In JSCallReducer::ReduceArrayPrototypeShift, add Unsigned32 TypeGuard for index Node used in fast path, avoid representing kRepFloat64 (Range(1, inf)) to kRepWord64 when converting input for kLoadElement. Bug: v8:12632 Change-Id: I2e4b00840dc5462e4351e13a372c33b6272b9ea1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528373 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#79514}
18 lines
412 B
JavaScript
18 lines
412 B
JavaScript
// Copyright 2022 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --interrupt-budget=1024 --noturbo-loop-variable
|
|
|
|
function opt() {
|
|
const array = [-1, 1];
|
|
array.shift();
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(opt);
|
|
opt();
|
|
opt();
|
|
%OptimizeFunctionOnNextCall(opt);
|
|
opt();
|
|
opt();
|