6254e98d5d
In this bug, we might replace a phi node with the Dead node even though it still has uses. DeadCodeElimination picks this up and inserts a runtime crash into the code. Bug: chromium:974474 Change-Id: Iea685913c8666806972719bbfb0891e516207d4f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669693 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#62352}
19 lines
410 B
JavaScript
19 lines
410 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(x) {
|
|
const y = x == 42;
|
|
() => {y};
|
|
if (y) { Object(); }
|
|
[!!y];
|
|
return y;
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
foo(42); foo(42);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo(42);
|