Reviewers: Jakob,
Description:
Fix IfBuilder::Deopt to clear the current block.
[email protected]
BUG=chromium:243868
TEST=mjsunit/regress/regress-crbug-243868
Please review this at https://codereview.chromium.org/16155003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen.cc
A + test/mjsunit/regress/regress-crbug-243868.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
1df062c9ee0abf73fec7b30b831c4ffa12f8f6ef..eef1d6b23b99189a17bed57d7266cb31a8e2c1b7
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -812,6 +812,7 @@ void HGraphBuilder::IfBuilder::Else() {
void HGraphBuilder::IfBuilder::Deopt() {
HBasicBlock* block = builder_->current_block();
block->FinishExitWithDeoptimization(HDeoptimize::kUseAll);
+ builder_->set_current_block(NULL);
if (did_else_) {
first_false_block_ = NULL;
} else {
@@ -7194,6 +7195,7 @@ HValue*
HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
// If only one map is left after transitioning, handle this case
// monomorphically.
+ ASSERT(num_untransitionable_maps >= 1);
if (num_untransitionable_maps == 1) {
HInstruction* instr = NULL;
if (untransitionable_map->has_slow_elements_kind()) {
Index: test/mjsunit/regress/regress-crbug-243868.js
diff --git a/test/mjsunit/regress/regress-crbug-242870.js
b/test/mjsunit/regress/regress-crbug-243868.js
similarity index 79%
copy from test/mjsunit/regress/regress-crbug-242870.js
copy to test/mjsunit/regress/regress-crbug-243868.js
index
7183375ca811cedc81c870d34e694e98cf727f9b..106d9cc78bce7795cd450fa0d07794f9f004a3af
100644
--- a/test/mjsunit/regress/regress-crbug-242870.js
+++ b/test/mjsunit/regress/regress-crbug-243868.js
@@ -29,15 +29,18 @@
var non_const_true = true;
-function f() {
- return (non_const_true || true && g());
+function f(o) {
+ return (non_const_true && (o.val == null || false));
}
-function g() {
- for (;;) {}
-}
+// Create an object with a constant function in another realm.
+var realm = Realm.create();
+var realmObject = Realm.eval(realm, "function g() {}; var o = { val:g };
o;")
+
+// Make the CompareNil IC in the function monomorphic.
+assertFalse(f(realmObject));
+assertFalse(f(realmObject));
-assertTrue(f());
-assertTrue(f());
+// Optimize the function containing the CompareNil IC.
%OptimizeFunctionOnNextCall(f);
-assertTrue(f());
+assertFalse(f(realmObject));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
