Skip to content
Browse files

[turbofan] Fix typer bug in Array.p.reduce[Right]

When finding the initial element in A.p.reduce[Right], we did
exclude holes, but did not reflect this is the type, which still
included the hole. This CL inserts a TypeGuard to ensure that
Turbofan knows the initial element is never the hole.

Bug: chromium:804837
Change-Id: Ia118ddafb8e16dd5c02559fa23216c9b139dd59a
Commit-Queue: Benedikt Meurer <>
Reviewed-by: Benedikt Meurer <>
Cr-Commit-Position: refs/heads/master@{#50814}
  • Loading branch information...
sigurdschneider authored and Commit Bot committed Jan 23, 2018
1 parent b711332 commit a9796a1d27185fdd8dc2c70d45712dc62c35f301
Showing with 17 additions and 0 deletions.
  1. +3 −0 src/compiler/
  2. +14 −0 test/mjsunit/regress/regress-804837.js
@@ -1126,6 +1126,9 @@ Reduction JSCallReducer::ReduceArrayReduce(Handle<JSFunction> function,
Node* is_hole = graph()->NewNode(common()->IfTrue(), hole_branch);

WireInLoopEnd(loop, eloop, vloop, next_k, is_hole, effect);
// We did the hole-check, so exclude hole from the type.
cur = effect = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
cur, effect, control);
k = next_k;

@@ -0,0 +1,14 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --opt --allow-natives-syntax

var __v_25662 = [, 1.8];
function __f_6214(__v_25668) {
__v_25662.reduce(() => {1});

0 comments on commit a9796a1

Please sign in to comment.
You can’t perform that action at this time.