Revision: 23799
Author: [email protected]
Date: Tue Sep 9 12:16:33 2014 UTC
Log: Hydrogen: bailout when there is a throw statement in a non-effect
context.
This mirrors the behavior of the compilation pipeline before recent
OptimizeFunctionOnNextCall changes.
BUG=chromium:412208
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/558593002
https://code.google.com/p/v8/source/detail?r=23799
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-crbug-412208.js
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-412208.js
Tue Sep 9 12:16:33 2014 UTC
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f() {
+ return non_const_true || (f() = this);
+}
+
+assertTrue(f());
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Mon Sep 8 15:18:54 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Tue Sep 9 12:16:33 2014 UTC
@@ -6753,10 +6753,12 @@
DCHECK(!HasStackOverflow());
DCHECK(current_block() != NULL);
DCHECK(current_block()->HasPredecessor());
- // We don't optimize functions with invalid left-hand sides in
- // assignments, count operations, or for-in. Consequently throw can
- // currently only occur in an effect context.
- DCHECK(ast_context()->IsEffect());
+ if (!ast_context()->IsEffect()) {
+ // The parser turns invalid left-hand sides in assignments into throw
+ // statements, which may not be in effect contexts. We might still try
+ // to optimize such functions; bail out now if we do.
+ return Bailout(kInvalidLeftHandSideInAssignment);
+ }
CHECK_ALIVE(VisitForValue(expr->exception()));
HValue* value = environment()->Pop();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
