Revision: 24416
Author: [email protected]
Date: Mon Oct 6 13:28:31 2014 UTC
Log: Version 3.29.88.4 (merged r24366)
Fix Hydrogen's BuildStore()
BUG=chromium:417508
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/629973003
https://code.google.com/p/v8/source/detail?r=24416
Added:
/branches/3.29/test/mjsunit/regress/regress-crbug-417508.js
Modified:
/branches/3.29/src/hydrogen.cc
/branches/3.29/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.29/test/mjsunit/regress/regress-crbug-417508.js Mon Oct 6
13:28:31 2014 UTC
@@ -0,0 +1,29 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var k = "value";
+ return x[k] = 1;
+}
+var obj = {};
+Object.defineProperty(obj, "value", {set: function(x) { throw "nope"; }});
+try { foo(obj); } catch(e) {}
+try { foo(obj); } catch(e) {}
+%OptimizeFunctionOnNextCall(foo);
+try { foo(obj); } catch(e) {}
+
+function bar(x) {
+ var k = "value";
+ return (x[k] = 1) ? "ok" : "nope";
+}
+var obj2 = {};
+Object.defineProperty(obj2, "value",
+ {set: function(x) { throw "nope"; return true; } });
+
+try { bar(obj2); } catch(e) {}
+try { bar(obj2); } catch(e) {}
+%OptimizeFunctionOnNextCall(bar);
+try { bar(obj2); } catch(e) {}
=======================================
--- /branches/3.29/src/hydrogen.cc Thu Sep 25 00:05:09 2014 UTC
+++ /branches/3.29/src/hydrogen.cc Mon Oct 6 13:28:31 2014 UTC
@@ -6426,16 +6426,19 @@
bool is_uninitialized) {
if (!prop->key()->IsPropertyName()) {
// Keyed store.
- HValue* value = environment()->ExpressionStackAt(0);
- HValue* key = environment()->ExpressionStackAt(1);
- HValue* object = environment()->ExpressionStackAt(2);
+ HValue* value = Pop();
+ HValue* key = Pop();
+ HValue* object = Pop();
bool has_side_effects = false;
- HandleKeyedElementAccess(object, key, value, expr, ast_id, return_id,
STORE,
- &has_side_effects);
- Drop(3);
- Push(value);
- Add<HSimulate>(return_id, REMOVABLE_SIMULATE);
- return ast_context()->ReturnValue(Pop());
+ HValue* result = HandleKeyedElementAccess(
+ object, key, value, expr, ast_id, return_id, STORE,
&has_side_effects);
+ if (has_side_effects) {
+ if (!ast_context()->IsEffect()) Push(value);
+ Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
+ if (!ast_context()->IsEffect()) Drop(1);
+ }
+ if (result == NULL) return;
+ return ast_context()->ReturnValue(value);
}
// Named store.
@@ -7065,7 +7068,7 @@
store_mode);
}
*has_side_effects |= instr->HasObservableSideEffects();
- return access_type == STORE ? NULL : instr;
+ return access_type == STORE ? val : instr;
}
HBasicBlock* join = graph()->CreateBasicBlock();
@@ -7118,7 +7121,7 @@
NoObservableSideEffectsScope scope(this);
FinishExitWithHardDeoptimization("Unknown map in polymorphic element
access");
set_current_block(join);
- return access_type == STORE ? NULL : Pop();
+ return access_type == STORE ? val : Pop();
}
=======================================
--- /branches/3.29/src/version.cc Tue Sep 30 08:24:23 2014 UTC
+++ /branches/3.29/src/version.cc Mon Oct 6 13:28:31 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 29
#define BUILD_NUMBER 88
-#define PATCH_LEVEL 3
+#define PATCH_LEVEL 4
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
