1ec7ffedc8
In reducers, we should avoid reductions of the form ReduceWithValue(node, replacement) return Replace(node) because such reduction does not kill the original node, so it may become subject to resurrection from some side table (in the bug referenced below it was load elimination's side table). Instead, we should use ReduceWithValue(node, replacement) return Replace(replacement) Bug: chromium:945644 Change-Id: Id210efe0d214a53241392d30b7f0eee8e7515e2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545229 Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#60517} |
||
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
test262 | ||
torque | ||
unittests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |