826627d9fd
This makes sure {NodeProperties::FindFrameStateBefore} can deal with
effect chains that are marked as dead. This can happen when reducers
looking for frame states run together with other reducers killing some
execution paths within the same reduction phase.
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-617567
BUG=chromium:617567,chromium:617224
Review-Url: https://codereview.chromium.org/2041833002
Cr-Commit-Position: refs/heads/master@{#36743}
25 lines
438 B
JavaScript
25 lines
438 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --turbo-filter=* --allow-natives-syntax
|
|
|
|
var v1 = {};
|
|
function g() {
|
|
v1 = [];
|
|
for (var i = 0; i < 1; i++) {
|
|
v1[i]();
|
|
}
|
|
}
|
|
|
|
var v2 = {};
|
|
var v3 = {};
|
|
function f() {
|
|
v3 = v2;
|
|
g();
|
|
}
|
|
|
|
assertThrows(g);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertThrows(f);
|