Reviewers: Benedikt Meurer,
Message:
Could you take a look, please?
Description:
[turbofan] Handle cyclic dependencies in context typing.
BUG=chromium:451012
LOG=n
[email protected]
Please review this at https://codereview.chromium.org/874983002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+26, -21 lines):
M src/compiler/typer.cc
A + test/mjsunit/compiler/regress-451012.js
Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index
4b3a8830a0fff9cbed6694b9588742225d262814..0694c9cba2f07f488d5163a79733dcbe6a279f1a
100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -316,14 +316,7 @@ class Typer::Visitor : public Reducer {
return BoundsOrNone(operand_node);
}
- Bounds ContextOperand(Node* node) {
- Bounds result = BoundsOrNone(NodeProperties::GetContextInput(node));
- DCHECK(result.upper->Maybe(Type::Internal()));
- // TODO(rossberg): More precisely, instead of the above assertion, we
should
- // back-propagate the constraint that it has to be a subtype of
Internal.
- return result;
- }
-
+ Bounds WrapContextBoundsForInput(Node* node);
Type* Weaken(Type* current_type, Type* previous_type);
Zone* zone() { return typer_->zone(); }
@@ -1381,40 +1374,45 @@ Bounds Typer::Visitor::TypeJSStoreContext(Node*
node) {
}
+Bounds Typer::Visitor::WrapContextBoundsForInput(Node* node) {
+ Bounds outer = BoundsOrNone(NodeProperties::GetContextInput(node));
+ if (outer.upper->Is(Type::None())) {
+ return Bounds(Type::None());
+ } else {
+ DCHECK(outer.upper->Maybe(Type::Internal()));
+ return Bounds(Type::Context(outer.upper, zone()));
+ }
+}
+
+
Bounds Typer::Visitor::TypeJSCreateFunctionContext(Node* node) {
- Bounds outer = ContextOperand(node);
- return Bounds(Type::Context(outer.upper, zone()));
+ return WrapContextBoundsForInput(node);
}
Bounds Typer::Visitor::TypeJSCreateCatchContext(Node* node) {
- Bounds outer = ContextOperand(node);
- return Bounds(Type::Context(outer.upper, zone()));
+ return WrapContextBoundsForInput(node);
}
Bounds Typer::Visitor::TypeJSCreateWithContext(Node* node) {
- Bounds outer = ContextOperand(node);
- return Bounds(Type::Context(outer.upper, zone()));
+ return WrapContextBoundsForInput(node);
}
Bounds Typer::Visitor::TypeJSCreateBlockContext(Node* node) {
- Bounds outer = ContextOperand(node);
- return Bounds(Type::Context(outer.upper, zone()));
+ return WrapContextBoundsForInput(node);
}
Bounds Typer::Visitor::TypeJSCreateModuleContext(Node* node) {
// TODO(rossberg): this is probably incorrect
- Bounds outer = ContextOperand(node);
- return Bounds(Type::Context(outer.upper, zone()));
+ return WrapContextBoundsForInput(node);
}
Bounds Typer::Visitor::TypeJSCreateScriptContext(Node* node) {
- Bounds outer = ContextOperand(node);
- return Bounds(Type::Context(outer.upper, zone()));
+ return WrapContextBoundsForInput(node);
}
Index: test/mjsunit/compiler/regress-451012.js
diff --git a/test/mjsunit/regress/regress-crbug-450642.js
b/test/mjsunit/compiler/regress-451012.js
similarity index 69%
copy from test/mjsunit/regress/regress-crbug-450642.js
copy to test/mjsunit/compiler/regress-451012.js
index
7f821e0ffc0cba83ca4544d9b61041e49d97d90e..bffc8bc5bdfac32bb561a24153d00157b26ac3a5
100644
--- a/test/mjsunit/regress/regress-crbug-450642.js
+++ b/test/mjsunit/compiler/regress-451012.js
@@ -2,4 +2,11 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-assertThrows(function() { with (undefined) {} }, TypeError);
+"use strict";
+function f() {
+ for (let v; v; ) {
+ let x;
+ }
+}
+
+f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
