b898112277
The previous typing rules for ToNumeric and ToNumber didn't match on the NonBigIntPrimitive input set, which causes trouble when we morph ToNumeric nodes into ToNumber nodes, and generally lead to worse typings in the graph, and thus worse code generation. This change improves the existing typing rules and turns ToNumber into a chokepoint again. Bug: chromium:879898, v8:8015 Change-Id: I4a7ff0e9c420c5dcfdb2b96884e019a5943828a4 Reviewed-on: https://chromium-review.googlesource.com/1201522 Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#55595}
13 lines
324 B
JavaScript
13 lines
324 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo() {
|
|
return Symbol.toPrimitive++;
|
|
}
|
|
assertThrows(foo);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertThrows(foo);
|