AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix OSR environment in for-in.

Browse Source 
BUG=chromium:607493
LOG=n

Review-Url: https://codereview.chromium.org/1949433002
Cr-Commit-Position: refs/heads/master@{#35982}
This commit is contained in:
jarin 2016-05-03 06:40:12 -07:00 committed by Commit bot
parent 7c6ff54e60
commit 2da181b08b
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/ast-graph-builder.cc
View File

@ -1398,10 +1398,10 @@ void AstGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
VisitIterationBody(stmt, &for_loop);
}
test_value.End();
index = environment()->Peek(0);
for_loop.EndBody();
// Increment counter and continue.
index = environment()->Peek(0);
index = NewNode(javascript()->ForInStep(), index);
environment()->Poke(0, index);
}

20
test/mjsunit/compiler/regress-607493.js Normal file
View File

@ -0,0 +1,20 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = [1];
function g() {
for (var x in a) {
try {
for (var i = 0; i < 10; i++) { %OptimizeOsr(); }
return;
} catch(e) {
continue;
}
}
}
g();