Revision: 20588
Author: [email protected]
Date: Wed Apr 9 07:35:12 2014 UTC
Log: Add stack overflow check for inlined property getter
We should check for overflow for each inlined property getter;
otherwise, we can get an overflow from inlining property getter while
still having pending overflow exception from some previous inlined
getter (in the same polymorphic access).
[email protected]
TEST=test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
Review URL: https://codereview.chromium.org/220813003
http://code.google.com/p/v8/source/detail?r=20588
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
Modified:
/branches/bleeding_edge/src/hydrogen.cc
=======================================
--- /dev/null
+++
/branches/bleeding_edge/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
Wed Apr 9 07:35:12 2014 UTC
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function runNearStackLimit(f) {
+ function t() {
+ try { t(); } catch(e) { f(); }
+ };
+ try { t(); } catch(e) {}
+}
+
+function g(x) { return x.bar; }
+function f1() { }
+function f2() { }
+
+var x = Object.defineProperty({}, "bar", { get: f1 });
+g(x);
+g(x);
+var y = Object.defineProperty({}, "bar", { get: f2 });
+g(y);
+%OptimizeFunctionOnNextCall(g);
+runNearStackLimit(function() { g(y); });
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Tue Apr 8 09:49:49 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Apr 9 07:35:12 2014 UTC
@@ -5649,7 +5649,7 @@
? TryInlineGetter(info->accessor(), info->map(), ast_id,
return_id)
: TryInlineSetter(
info->accessor(), info->map(), ast_id, return_id, value);
- if (success) return NULL;
+ if (success || HasStackOverflow()) return NULL;
}
PushArgumentsFromEnvironment(argument_count);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
