104d75214e
When replacing a LoadElement with variable index with its known fields, only do it if the types match, otherwise we end up with a graph that representation selection cannot handle. That can only happen in dead code, but TurboFan would nevertheless crash in representation selection. Bug: chromium:893982, chromium:899524, v8:5267, v8:6200 Change-Id: I01e645d5e01bffb911d216d37d923792d9d0beab Reviewed-on: https://chromium-review.googlesource.com/c/1303721 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57059}
34 lines
670 B
JavaScript
34 lines
670 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function empty() { }
|
|
|
|
function baz(expected, found) {
|
|
var start = "";
|
|
found.length, start + 'x';
|
|
if (expected.length === found.length) {
|
|
for (var i = 0; i < expected.length; ++i) {
|
|
empty(found[i]);
|
|
}
|
|
}
|
|
}
|
|
|
|
baz([1], new (class A extends Array {}));
|
|
|
|
(function () {
|
|
"use strict";
|
|
function bar() {
|
|
baz([1,2], arguments);
|
|
}
|
|
function foo() {
|
|
bar(2147483648,-[]);
|
|
}
|
|
foo();
|
|
foo();
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|
|
})();
|