DescriptionTreat HArgumentsObject as a safe use during Uint32 analysis phase.
Deoptimization infrastructure already handles it correctly.
This change fixes repetitive deoptimizations in the code like this:
var u32 = new Uint32Array(1);
u32[0] = -1;
function tr(x) { return x|0; }
function ld() { return tr(u32[0]); }
while (true) ld();
Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.
BUG=
Committed: https://crrev.com/021f738127406ef6ff8868465ff32b59edaff016
Cr-Commit-Position: refs/heads/master@{#27781}
Patch Set 1 #Patch Set 2 : remove assertOptimized #
Messages
Total messages: 7 (2 generated)
|