• jarin's avatar
    [turbofan] Restrict types in load elimination. · 4142bc6b
    jarin authored
    In simplified numbering, we make sanity checks based on types (e.g.,
    NumberSubtract should take numbers as inputs), but this can be
    violated if optimization passes make types less precise.
    
    In this CL, we fix load elimination to make sure that types are
    smaller in the store -> load elimination by taking an intersection
    of the load's type with the store value's type and inserting a guard
    with that type. Note that the load type comes from type feedback, so
    it can be disjoint from the stored value type (in that case, this
    must be dead code because the map chack for the load should prevent
    us from using the stored value).
    
    BUG=chromium:599412
    LOG=n
    
    Review URL: https://codereview.chromium.org/1857133003
    
    Cr-Commit-Position: refs/heads/master@{#35259}
    4142bc6b
regress-599412.js 380 Bytes