Commit e913f9e3 authored by bmeurer's avatar bmeurer Committed by Commit bot

[turbofan] Fix buggy implicit coercion in GetMapWitness.

BUG=chromium:715151
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2839873004
Cr-Commit-Position: refs/heads/master@{#44881}
parent a6b27a72
......@@ -113,8 +113,10 @@ MaybeHandle<Map> GetMapWitness(Node* node) {
ZoneHandleSet<Map> maps;
Node* receiver = NodeProperties::GetValueInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node);
if (NodeProperties::InferReceiverMaps(receiver, effect, &maps)) {
if (maps.size() == 1) return MaybeHandle<Map>(maps[0]);
NodeProperties::InferReceiverMapsResult result =
NodeProperties::InferReceiverMaps(receiver, effect, &maps);
if (result == NodeProperties::kReliableReceiverMaps && maps.size() == 1) {
return maps[0];
}
return MaybeHandle<Map>();
}
......
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --verify-heap
function foo() {
var a = [0];
Object.preventExtensions(a);
return a.pop();
}
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment