Revision: 4182
Author: [email protected]
Date: Thu Mar 18 07:32:02 2010
Log: Fix bug when generating a fast smi loop.
We may encounter an invalid frame after generating code
for the loop body in case the loop body ends in an unconditional
return. Before setting the type information for the loop variable
we need to check for a valid frame.
Review URL: http://codereview.chromium.org/1106002
http://code.google.com/p/v8/source/detail?r=4182
Modified:
/branches/bleeding_edge/src/ia32/codegen-ia32.cc
/branches/bleeding_edge/test/mjsunit/compiler/loopcount.js
=======================================
--- /branches/bleeding_edge/src/ia32/codegen-ia32.cc Thu Mar 18 03:01:53
2010
+++ /branches/bleeding_edge/src/ia32/codegen-ia32.cc Thu Mar 18 07:32:02
2010
@@ -3766,7 +3766,7 @@
// Set the type of the loop variable to smi before compiling the test
// expression if we are in a fast smi loop condition.
- if (node->is_fast_smi_loop()) {
+ if (node->is_fast_smi_loop() && has_valid_frame()) {
// Set number type of the loop variable to smi.
Slot* slot = node->loop_variable()->slot();
ASSERT(slot->type() == Slot::LOCAL);
=======================================
--- /branches/bleeding_edge/test/mjsunit/compiler/loopcount.js Thu Mar 18
02:08:24 2010
+++ /branches/bleeding_edge/test/mjsunit/compiler/loopcount.js Thu Mar 18
07:32:02 2010
@@ -75,3 +75,12 @@
return i;
}
assertEquals(0x40000002, f8());
+
+
+function f9() {
+ var i;
+ for (i = 0; i < 42; i++) {
+ return 42;
+ }
+}
+assertEquals(42, f9());
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
