29dd7fc5ed
Extract String feedback on Add operation and utilize to lower ConsString creation in JSTypedLowering when we know that a String addition will definitely result in the creation of a ConsString. Note that Crankshaft has to guard the potential length overflow of the resulting string with an eager deoptimization exit, while we can safely throw an exception in that case. Also note that the bytecode pipeline does not currently provide the String feedback for the addition, which has to be added. BUG=v8:5267 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2354853002 Cr-Commit-Position: refs/heads/master@{#39540}
40 lines
723 B
JavaScript
40 lines
723 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var a = "a".repeat(268435440);
|
|
|
|
(function() {
|
|
function foo(a, b) {
|
|
try {
|
|
return a + "0123456789012";
|
|
} catch (e) {
|
|
return e;
|
|
}
|
|
}
|
|
|
|
foo("a");
|
|
foo("a");
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo("a");
|
|
assertInstanceof(foo(a), RangeError);
|
|
})();
|
|
|
|
(function() {
|
|
function foo(a, b) {
|
|
try {
|
|
return "0123456789012" + a;
|
|
} catch (e) {
|
|
return e;
|
|
}
|
|
}
|
|
|
|
foo("a");
|
|
foo("a");
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo("a");
|
|
assertInstanceof(foo(a), RangeError);
|
|
})();
|