AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix Hydrogen's BuildStore()

Browse Source 
BUG=chromium:417508
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/612423002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2014-10-01 13:17:34 +00:00
parent d6eea5742d
commit 1bb52d0da8
2 changed files with 43 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/hydrogen.cc
View File

@ -6450,16 +6450,19 @@ void HOptimizedGraphBuilder::BuildStore(Expression* expr,
bool is_uninitialized) {
if (!prop->key()->IsPropertyName()) {
// Keyed store.
HValue* value = environment()->ExpressionStackAt(0);
HValue* key = environment()->ExpressionStackAt(1);
HValue* object = environment()->ExpressionStackAt(2);
HValue* value = Pop();
HValue* key = Pop();
HValue* object = Pop();
bool has_side_effects = false;
HandleKeyedElementAccess(object, key, value, expr, ast_id, return_id, STORE,
&has_side_effects);
Drop(3);
Push(value);
Add<HSimulate>(return_id, REMOVABLE_SIMULATE);
return ast_context()->ReturnValue(Pop());
HValue* result = HandleKeyedElementAccess(
object, key, value, expr, ast_id, return_id, STORE, &has_side_effects);
if (has_side_effects) {
if (!ast_context()->IsEffect()) Push(value);
Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
if (!ast_context()->IsEffect()) Drop(1);
}
if (result == NULL) return;
return ast_context()->ReturnValue(value);
}
// Named store.
@ -7089,7 +7092,7 @@ HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
store_mode);
}
*has_side_effects |= instr->HasObservableSideEffects();
return access_type == STORE ? NULL : instr;
return access_type == STORE ? val : instr;
}
HBasicBlock* join = graph()->CreateBasicBlock();
@ -7142,7 +7145,7 @@ HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
NoObservableSideEffectsScope scope(this);
FinishExitWithHardDeoptimization("Unknown map in polymorphic element access");
set_current_block(join);
return access_type == STORE ? NULL : Pop();
return access_type == STORE ? val : Pop();
}

29
test/mjsunit/regress/regress-crbug-417508.js Normal file
View File

@ -0,0 +1,29 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(x) {
var k = "value";
return x[k] = 1;
}
var obj = {};
Object.defineProperty(obj, "value", {set: function(x) { throw "nope"; }});
try { foo(obj); } catch(e) {}
try { foo(obj); } catch(e) {}
%OptimizeFunctionOnNextCall(foo);
try { foo(obj); } catch(e) {}
function bar(x) {
var k = "value";
return (x[k] = 1) ? "ok" : "nope";
}
var obj2 = {};
Object.defineProperty(obj2, "value",
{set: function(x) { throw "nope"; return true; } });
try { bar(obj2); } catch(e) {}
try { bar(obj2); } catch(e) {}
%OptimizeFunctionOnNextCall(bar);
try { bar(obj2); } catch(e) {}