6328c56570
DeadValue was a constant node of type None. This is unsound in the presence of re-scheduling. This CL adds a value input to DeadValue, which preserves the dependency on the original node of type None. This reland addresses the bug that the EffectControlLinearizer could destroy dependencies of DeadValue by attaching DeadValue nodes to the effect chain in the EffectControlLinearizer. Bug: chromium:796041 chromium:798938 Change-Id: If47b54a7986d257eb63b437f855769b503679ff5 Reviewed-on: https://chromium-review.googlesource.com/850392 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#50360}
36 lines
656 B
JavaScript
36 lines
656 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
'use strict';
|
|
|
|
function f(abort, n, a, b) {
|
|
if (abort) return;
|
|
var x = a ? true : "" + a;
|
|
if (!a) {
|
|
var dead = n + 1 + 1;
|
|
if(!b) {
|
|
x = dead;
|
|
}
|
|
if (x) {
|
|
x = false;
|
|
}
|
|
if (b) {
|
|
x = false;
|
|
}
|
|
}
|
|
return x + 1;
|
|
}
|
|
f(false, 5); f(false, 6); f(false, 7); f(false, 8);
|
|
|
|
function g(abort, a, b) {
|
|
return f(abort, "abc", a, b);
|
|
}
|
|
|
|
g(true); g(true); g(true); g(true);
|
|
|
|
%OptimizeFunctionOnNextCall(g);
|
|
g(false);
|