-
jameslahm authored
In JSCallReducer::ReduceArrayPrototypeShift, add Unsigned32 TypeGuard for index Node used in fast path, avoid representing kRepFloat64 (Range(1, inf)) to kRepWord64 when converting input for kLoadElement. Bug: v8:12632 Change-Id: I2e4b00840dc5462e4351e13a372c33b6272b9ea1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528373Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#79514}
e66a1116