f27ac2806c
Currently, if we lower to a pure computation that is unreachable because of some runtime check, we just rename it with DeadValue. This is problematic if the pure computation gets later eliminated - that allows the DeadValue node float above the check that makes it dead. As we conservatively lower DeadValues to debug-break (i.e., crash), we might induce crash where we should not. With this CL, whenever we lower an impossible effectful node (i.e., with Type::None) to a pure node in simplified lowering, we insert an Unreachable node there (pinned to the effect chain) and mark the impossible node dead (and make it depend on the Unreachable node). Bug: chromium:910838 Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2 Reviewed-on: https://chromium-review.googlesource.com/c/1365274 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#58066}
21 lines
426 B
JavaScript
21 lines
426 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f(b, s, x) {
|
|
if (!b) {
|
|
return (x ? b : s * undefined) ? 1 : 42;
|
|
}
|
|
}
|
|
|
|
function g(b, x) {
|
|
return f(b, 'abc', x);
|
|
}
|
|
|
|
f(false, 0, 0);
|
|
g(true, 0);
|
|
%OptimizeFunctionOnNextCall(g);
|
|
assertEquals(42, g(false, 0));
|