6cd2d4ba41
This avoids using kTaggedSigned and kTaggedPointer because the semantic information of those type could be invalid in unreachable code. For example, SmiCheck(0.1) has representation TaggedSigned, but it is later compiled to DeoptimizeUnless(ObjectIsSmi(0.1)) with the constant 0.1 directly connected to the uses. If the use is state-values, which recorded the TaggedSigned representation of CheckSmi, the code generator will be confused because it will see constant 0.1 that claims to be TaggedSigned value. BUG=chromium:675704 Review-Url: https://codereview.chromium.org/2656243004 Cr-Commit-Position: refs/heads/master@{#42756}
27 lines
506 B
JavaScript
27 lines
506 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(a) {
|
|
this.a = a;
|
|
// Note that any call would do, it doesn't need to be %MaxSmi()
|
|
this.x = this.a + %MaxSmi();
|
|
}
|
|
|
|
function g(x) {
|
|
new foo(2);
|
|
|
|
if (x) {
|
|
for (var i = 0.1; i < 1.1; i++) {
|
|
new foo(i);
|
|
}
|
|
}
|
|
}
|
|
|
|
g(false);
|
|
g(false);
|
|
%OptimizeFunctionOnNextCall(g);
|
|
g(true);
|