eaf2a23bc7
Boilerplate values may possess an unboxed double field filled with the kHoleNan64Int sentinel value, which indicates that the field is uninitialized. When a boilerplate value migrates away from the unboxed double representation to a tagged one, we should replace the sentinel value by the proper uninitialized oddball value. This fixes an issue with JSCreateLowering::AllocateFastLiteral not detecting const stores of uninitialized values properly. R=bmeurer@chromium.org, jarin@chromium.org Bug: chromium:976598 Change-Id: I6bb216c0618a3105e6c8cfc04b1900d2f83a52ce Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1674034 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Georg Schmid <gsps@google.com> Cr-Commit-Position: refs/heads/master@{#62394}
19 lines
354 B
JavaScript
19 lines
354 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f() {
|
|
return { value: NaN };
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(f);
|
|
f();
|
|
f();
|
|
|
|
let x = { value: "Y" };
|
|
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f();
|