Index: src/compiler/verifier.cc |
diff --git a/src/compiler/verifier.cc b/src/compiler/verifier.cc |
index 92ac30d7e6607e45810eb8d4facc58f390d7ce5d..22ed14d5854572ed81934d9bf14ea114f253f6f4 100644 |
--- a/src/compiler/verifier.cc |
+++ b/src/compiler/verifier.cc |
@@ -720,8 +720,16 @@ void Verifier::Visitor::Check(Node* node) { |
// Type is Receiver. |
CheckTypeIs(node, Type::Receiver()); |
break; |
- case IrOpcode::kJSCallForwardVarargs: |
+ case IrOpcode::kJSCallVarargs: { |
+ int arity = static_cast<int>(CallVarargsParametersOf(node->op()).arity()); |
+ CheckValueInputIs(node, arity + 0, Type::OtherInternal()); |
+ CheckValueInputIs(node, arity + 1, Type::Signed32()); |
+ // Type can be any JavaScript value. |
+ CheckTypeIs(node, Type::NonInternal()); |
+ break; |
+ } |
case IrOpcode::kJSCall: |
+ case IrOpcode::kJSCallForwardVarargs: |
case IrOpcode::kJSCallWithArrayLike: |
case IrOpcode::kJSCallWithSpread: |
case IrOpcode::kJSCallRuntime: |