v8/test/mjsunit/regress/regress-919340.js
Sigurd Schneider 5a9fa8f304 [turbofan] Restrict redundancy elimination from widening types
This CL prevents redundancy elimination from widening types, which
can cause problems if the input of a DeadValue (which has type None)
is replaced by an equivalent node that does not have type None. This
can happen because load elimination does not re-type nodes, for
example.

Bug: chromium:919340
Change-Id: I89e872412edbcdc610e70ae160cde56cd045006c
Reviewed-on: https://chromium-review.googlesource.com/c/1397709
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58617}
2019-01-08 09:48:28 +00:00

18 lines
371 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --opt
var E = 'Σ';
var PI = 123;
function f() {
print(E = 2, /b/.test(E) || /b/.test(E = 2));
((E = 3) * PI);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();