v8/test/mjsunit/regress/regress-804837.js
Sigurd Schneider a9796a1d27 [turbofan] Fix typer bug in Array.p.reduce[Right]
When finding the initial element in A.p.reduce[Right], we did
exclude holes, but did not reflect this is the type, which still
included the hole. This CL inserts a TypeGuard to ensure that
Turbofan knows the initial element is never the hole.

Bug: chromium:804837
Change-Id: Ia118ddafb8e16dd5c02559fa23216c9b139dd59a
Reviewed-on: https://chromium-review.googlesource.com/880967
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50814}
2018-01-23 17:20:17 +00:00

15 lines
375 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --opt --allow-natives-syntax
var __v_25662 = [, 1.8];
function __f_6214(__v_25668) {
__v_25662.reduce(() => {1});
}
__f_6214();
__f_6214();
%OptimizeFunctionOnNextCall(__f_6214);
__f_6214();