94bbb8bb09
The analysis phase used to skip TypeGuard nodes, which are normally re-introduced by the reduction phase. However, phi nodes are created during the analysis phase already, and so it could happen that a phi input skips a TypeGuard. This CL solves the problem by not removing TypeGuard nodes in the first place, but only forwarding the VirtualObject. This is analogous to how we already treat FinishRegion nodes, which are similar in that they are a renaming too. Bug: chromium:741225 Change-Id: Icf8aa2d40a30d89788d875b37b9986111f9c966f Reviewed-on: https://chromium-review.googlesource.com/958442 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#51863}
24 lines
462 B
JavaScript
24 lines
462 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turbo-escape
|
|
|
|
function bar(arr) {
|
|
var x = 0;
|
|
arr.forEach(function(el) {
|
|
x = el;
|
|
});
|
|
return x;
|
|
}
|
|
|
|
function foo(array) {
|
|
return bar(array);
|
|
}
|
|
|
|
let array = [,.5,];
|
|
foo(array);
|
|
foo(array);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo(array);
|