4142bc6bc1
In simplified numbering, we make sanity checks based on types (e.g., NumberSubtract should take numbers as inputs), but this can be violated if optimization passes make types less precise. In this CL, we fix load elimination to make sure that types are smaller in the store -> load elimination by taking an intersection of the load's type with the store value's type and inserting a guard with that type. Note that the load type comes from type feedback, so it can be disjoint from the stored value type (in that case, this must be dead code because the map chack for the load should prevent us from using the stored value). BUG=chromium:599412 LOG=n Review URL: https://codereview.chromium.org/1857133003 Cr-Commit-Position: refs/heads/master@{#35259}
23 lines
380 B
JavaScript
23 lines
380 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function h(a) {
|
|
if (!a) return false;
|
|
print();
|
|
}
|
|
|
|
function g(a) { return a.length; }
|
|
g('0');
|
|
g('1');
|
|
|
|
function f() {
|
|
h(g([]));
|
|
}
|
|
|
|
f();
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f();
|