AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[parser] Skipping inner funcs: Fix bailout.

Browse Source 
When the bailout triggered, we assumed we're generating data (i.e., we're inside
a non-arrow function). This is not true; it's possible that we're already inside
an arrow function and not generating data anyway.

BUG=v8:5516,chromium:761980

Change-Id: Iad9c8dde283031630953ef9a46c1e68bc0cee048
Reviewed-on: https://chromium-review.googlesource.com/655081
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47905}
This commit is contained in:
Marja Hölttä 2017-09-07 14:45:30 +02:00 committed by Commit Bot
parent 59798cc800
commit 566e972395
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/parsing/preparser.cc
View File

@ -374,8 +374,8 @@ PreParserStatement PreParser::BuildParameterInitializationBlock(
DCHECK(!parameters.is_simple);
DCHECK(scope()->is_function_scope());
if (FLAG_preparser_scope_analysis &&
scope()->AsDeclarationScope()->calls_sloppy_eval()) {
DCHECK_NOT_NULL(produced_preparsed_scope_data_);
scope()->AsDeclarationScope()->calls_sloppy_eval() &&
produced_preparsed_scope_data_ != nullptr) {
// We cannot replicate the Scope structure constructed by the Parser,
// because we've lost information whether each individual parameter was
// simple or not. Give up trying to produce data to skip inner functions.

6
test/mjsunit/skipping-inner-functions-bailout.js
View File

@ -76,3 +76,9 @@ function TestMultiBailout3() {
function not_skippable_either() {}
}
TestMultiBailout3();
// Regression test for
// https://bugs.chromium.org/p/chromium/issues/detail?id=761980. The conditions
// triggering a bailout occur in a context where we're not generating data
// anyway (inside an arrow function). (This needs to be at top level.)
x => { (y=eval()) => {} }