Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(113)

Unified Diff: src/compiler/js-builtin-reducer.cc

Issue 2653273004: [turbofan] Ensure {CheckMaps} is not used accross mutations. (Closed)
Patch Set: Created 3 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-685506.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
index bf72ca47302545484b5bef10b88627210a6daa63..78e5a93f3d04f14fabce015b15b7ea2314800603 100644
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -121,7 +121,9 @@ MaybeHandle<Map> GetMapWitness(Node* node) {
return (maps.size() == 1) ? MaybeHandle<Map>(maps[0])
: MaybeHandle<Map>();
}
- if (dominator->op()->EffectInputCount() != 1) {
+ DCHECK_EQ(1, dominator->op()->EffectOutputCount());
+ if (dominator->op()->EffectInputCount() != 1 ||
+ !dominator->op()->HasProperty(Operator::kNoWrite)) {
// Didn't find any appropriate CheckMaps node.
return MaybeHandle<Map>();
}
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-685506.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698