• vegorov's avatar
    Treat HArgumentsObject as a safe use during Uint32 analysis phase. · 021f7381
    vegorov authored
    Deoptimization infrastructure already handles it correctly.
    
    This change fixes repetitive deoptimizations in the code like this:
    
        var u32 = new Uint32Array(1);
        u32[0] = -1;
    
        function tr(x) { return x|0; }
        function ld() { return tr(u32[0]); }
    
        while (true) ld();
    
    Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.
    
    BUG=
    
    Review URL: https://codereview.chromium.org/1077113002
    
    Cr-Commit-Position: refs/heads/master@{#27781}
    021f7381
uint32.js 6 KB