Reviewers: rossberg, Yang,
Message:
AstTyper::VisitStatements() contains the optimization "if (stmt->IsJump())
break;". Other AstVisitors, in particular the HOptimizedGraphBuilder, must
do
the same, or they will stumble over uninitialized type feedback (empty
handles)
in nodes that the typer has skipped.
An alternative implementation would be to remove the early return from the
AstTyper, but I think it's a valid optimization, so we should just do it
everywhere.
Description:
Make VisitStatements() consistent among all AstVisitor implementations
Please review this at https://codereview.chromium.org/23441018/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ast.cc
M src/hydrogen.cc
A + test/mjsunit/compiler/type-feedback-after-throw.js
Index: src/ast.cc
diff --git a/src/ast.cc b/src/ast.cc
index
38c6dddf9495b1915c56f30bcc2d28cda7138312..873417119ccd197806f1ab86e632f202032f21fd
100644
--- a/src/ast.cc
+++ b/src/ast.cc
@@ -708,7 +708,9 @@ void
AstVisitor::VisitDeclarations(ZoneList<Declaration*>* declarations) {
void AstVisitor::VisitStatements(ZoneList<Statement*>* statements) {
for (int i = 0; i < statements->length(); i++) {
- Visit(statements->at(i));
+ Statement* stmt = statements->at(i);
+ Visit(stmt);
+ if (stmt->IsJump()) break;
}
}
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
27d52a8795ac99167ea06f863d2c10f86a60117a..feacefd68df18d79604da8a1a03af2a2ac9981d1
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -3113,7 +3113,9 @@ void HOptimizedGraphBuilder::SetUpScope(Scope* scope)
{
void HOptimizedGraphBuilder::VisitStatements(ZoneList<Statement*>*
statements) {
for (int i = 0; i < statements->length(); i++) {
- CHECK_ALIVE(Visit(statements->at(i)));
+ Statement* stmt = statements->at(i);
+ CHECK_ALIVE(Visit(stmt));
+ if (stmt->IsJump()) break;
}
}
Index: test/mjsunit/compiler/type-feedback-after-throw.js
diff --git a/test/mjsunit/regress/regress-171641.js
b/test/mjsunit/compiler/type-feedback-after-throw.js
similarity index 91%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/compiler/type-feedback-after-throw.js
index
8db6781821325f8f6253eb2df4abb2b362b001c0..891e315c5c1121fb1674ee4094890266a7708889
100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/compiler/type-feedback-after-throw.js
@@ -27,14 +27,12 @@
// Flags: --allow-natives-syntax
-function foo(k, p) {
- for (var i = 0; i < 1; i++) {
- p = Math.min(p, i);
- }
- m = Math.floor((k | 0) / p);
-}
+function foo() {
+ throw "Error";
+ return 1 > 5;
+};
-foo(0, 1);
-foo(0, 1);
+try { foo() } catch(e) {}
+try { foo() } catch(e) {}
%OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+try { foo() } catch(e) {}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
