diff --git a/deps/v8/src/compiler/load-elimination.cc b/deps/v8/src/compiler/load-elimination.cc index 53d5d794d9a978..b3ab8fa0166e55 100644 --- a/deps/v8/src/compiler/load-elimination.cc +++ b/deps/v8/src/compiler/load-elimination.cc @@ -21,7 +21,7 @@ bool IsRename(Node* node) { switch (node->opcode()) { case IrOpcode::kFinishRegion: case IrOpcode::kTypeGuard: - return true; + return !node->IsDead(); default: return false; } diff --git a/deps/v8/test/mjsunit/regress/regress-906406.js b/deps/v8/test/mjsunit/regress/regress-906406.js new file mode 100644 index 00000000000000..eb79ff0a0ce368 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-906406.js @@ -0,0 +1,7 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +for (x = 0; x < 10000; ++x) { + [(x) => x, [, 4294967295].find((x) => x), , 2].includes('x', -0); +}