v8/test/mjsunit/compiler/regress-817225.js
Tobias Tebbi b8abd2736e [turbofan] remove type-widening NaN-addition folding
Folding _ + NaN => NaN can widen type None to a constant type, which leads to floating DeadValue nodes. This CL fixes this by removing the optimization. Alternatively, we should consider removing all nodes of type None in simplified lowering.

Bug: chromium:817225
Change-Id: I2a126b360d70d3626f8a3c5e73ac72dc980ac8b3
Reviewed-on: https://chromium-review.googlesource.com/946129
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51699}
2018-03-02 14:19:59 +00:00

28 lines
570 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
function inlined(abort, n, a, b) {
if (abort) return;
var x = a ? true : "" + a;
if (!a) {
var y = n + y + 10;
if(!b) {
x = y;
}
if (x) {
x = false;
}
}
return x + 1;
}
inlined();
function optimized(abort, a, b) {
return inlined(abort, "abc", a, b);
}
optimized(true);
%OptimizeFunctionOnNextCall(optimized);
optimized();