Reviewers: Søren Gjesse, Description: Fix bug when generating a fast smi loop.
We may encounter an invalid frame after generating code for the loop body in case the loop body ends in an unconditional return. Before setting the type information for the loop variable we need to check for a valid frame. Please review this at http://codereview.chromium.org/1106002 SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/ia32/codegen-ia32.cc M test/mjsunit/compiler/loopcount.js Index: src/ia32/codegen-ia32.cc =================================================================== --- src/ia32/codegen-ia32.cc (revision 4177) +++ src/ia32/codegen-ia32.cc (working copy) @@ -3766,7 +3766,7 @@ // Set the type of the loop variable to smi before compiling the test // expression if we are in a fast smi loop condition. - if (node->is_fast_smi_loop()) { + if (node->is_fast_smi_loop() && has_valid_frame()) { // Set number type of the loop variable to smi. Slot* slot = node->loop_variable()->slot(); ASSERT(slot->type() == Slot::LOCAL); Index: test/mjsunit/compiler/loopcount.js =================================================================== --- test/mjsunit/compiler/loopcount.js (revision 4174) +++ test/mjsunit/compiler/loopcount.js (working copy) @@ -75,3 +75,12 @@ return i; } assertEquals(0x40000002, f8()); + + +function f9() { + var i; + for (i = 0; i < 42; i++) { + return 42; + } +} +assertEquals(42, f9()); -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
