diff --git a/src/crankshaft/hydrogen-instructions.h b/src/crankshaft/hydrogen-instructions.h index 514882145f2..b10e3ab819c 100644 --- a/src/crankshaft/hydrogen-instructions.h +++ b/src/crankshaft/hydrogen-instructions.h @@ -4370,6 +4370,11 @@ class HAdd final : public HArithmeticBinaryOperation { SetChangesFlag(kNewSpacePromotion); ClearFlag(kAllowUndefinedAsNaN); } + if (!right()->type().IsTaggedNumber() && + !right()->representation().IsDouble() && + !right()->representation().IsSmiOrInteger32()) { + ClearFlag(kAllowUndefinedAsNaN); + } } Representation RepresentationFromInputs() override; diff --git a/test/mjsunit/compiler/regress-5074.js b/test/mjsunit/compiler/regress-5074.js new file mode 100644 index 00000000000..903b54ad980 --- /dev/null +++ b/test/mjsunit/compiler/regress-5074.js @@ -0,0 +1,18 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +var s = [,0.1]; + +function foo(a, b) { + var x = s[a]; + s[1] = 0.1; + return x + b; +} + +assertEquals(2.1, foo(1, 2)); +assertEquals(2.1, foo(1, 2)); +%OptimizeFunctionOnNextCall(foo); +assertEquals("undefined2", foo(0, "2"));