[turbofan] Fix deopt for assignments in non-effect context.
BUG= R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/701853002 Cr-Commit-Position: refs/heads/master@{#25151} git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
parent
1b4c25e0b7
commit
91eeae5849
@ -1173,8 +1173,8 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
|
||||
switch (assign_type) {
|
||||
case VARIABLE: {
|
||||
Variable* variable = expr->target()->AsVariableProxy()->var();
|
||||
BuildVariableAssignment(variable, value, expr->op(),
|
||||
expr->AssignmentId());
|
||||
BuildVariableAssignment(variable, value, expr->op(), expr->AssignmentId(),
|
||||
ast_context()->GetStateCombine());
|
||||
break;
|
||||
}
|
||||
case NAMED_PROPERTY: {
|
||||
@ -1183,7 +1183,8 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
|
||||
MakeUnique(property->key()->AsLiteral()->AsPropertyName());
|
||||
Node* store =
|
||||
NewNode(javascript()->StoreNamed(strict_mode(), name), object, value);
|
||||
PrepareFrameState(store, expr->AssignmentId());
|
||||
PrepareFrameState(store, expr->AssignmentId(),
|
||||
ast_context()->GetStateCombine());
|
||||
break;
|
||||
}
|
||||
case KEYED_PROPERTY: {
|
||||
@ -1191,7 +1192,8 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
|
||||
Node* object = environment()->Pop();
|
||||
Node* store = NewNode(javascript()->StoreProperty(strict_mode()), object,
|
||||
key, value);
|
||||
PrepareFrameState(store, expr->AssignmentId());
|
||||
PrepareFrameState(store, expr->AssignmentId(),
|
||||
ast_context()->GetStateCombine());
|
||||
break;
|
||||
}
|
||||
}
|
||||
@ -1957,9 +1959,9 @@ Node* AstGraphBuilder::BuildVariableDelete(
|
||||
}
|
||||
|
||||
|
||||
Node* AstGraphBuilder::BuildVariableAssignment(Variable* variable, Node* value,
|
||||
Token::Value op,
|
||||
BailoutId bailout_id) {
|
||||
Node* AstGraphBuilder::BuildVariableAssignment(
|
||||
Variable* variable, Node* value, Token::Value op, BailoutId bailout_id,
|
||||
OutputFrameStateCombine combine) {
|
||||
Node* the_hole = jsgraph()->TheHoleConstant();
|
||||
VariableMode mode = variable->mode();
|
||||
switch (variable->location()) {
|
||||
@ -1969,7 +1971,7 @@ Node* AstGraphBuilder::BuildVariableAssignment(Variable* variable, Node* value,
|
||||
Unique<Name> name = MakeUnique(variable->name());
|
||||
const Operator* op = javascript()->StoreNamed(strict_mode(), name);
|
||||
Node* store = NewNode(op, global, value);
|
||||
PrepareFrameState(store, bailout_id);
|
||||
PrepareFrameState(store, bailout_id, combine);
|
||||
return store;
|
||||
}
|
||||
case Variable::PARAMETER:
|
||||
@ -2035,7 +2037,7 @@ Node* AstGraphBuilder::BuildVariableAssignment(Variable* variable, Node* value,
|
||||
const Operator* op =
|
||||
javascript()->CallRuntime(Runtime::kStoreLookupSlot, 4);
|
||||
Node* store = NewNode(op, value, current_context(), name, strict);
|
||||
PrepareFrameState(store, bailout_id);
|
||||
PrepareFrameState(store, bailout_id, combine);
|
||||
return store;
|
||||
}
|
||||
}
|
||||
|
@ -80,7 +80,9 @@ class AstGraphBuilder : public StructuredGraphBuilder, public AstVisitor {
|
||||
|
||||
// Builders for variable load and assignment.
|
||||
Node* BuildVariableAssignment(Variable* var, Node* value, Token::Value op,
|
||||
BailoutId bailout_id);
|
||||
BailoutId bailout_id,
|
||||
OutputFrameStateCombine state_combine =
|
||||
OutputFrameStateCombine::Ignore());
|
||||
Node* BuildVariableDelete(Variable* var, BailoutId bailout_id,
|
||||
OutputFrameStateCombine state_combine);
|
||||
Node* BuildVariableLoad(Variable* var, BailoutId bailout_id,
|
||||
|
20
test/mjsunit/regress/regress-assignment-in-test-context.js
Normal file
20
test/mjsunit/regress/regress-assignment-in-test-context.js
Normal file
@ -0,0 +1,20 @@
|
||||
// Copyright 2014 the V8 project authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style license that can be
|
||||
// found in the LICENSE file.
|
||||
|
||||
// Flags: --allow-natives-syntax --always-opt
|
||||
// Flags: --turbo-filter=* --turbo-deoptimization
|
||||
|
||||
function assertEquals() {}
|
||||
|
||||
function f(o) {
|
||||
if (o.setterProperty = 0) {
|
||||
return 1;
|
||||
}
|
||||
return 2;
|
||||
}
|
||||
|
||||
function deopt() { %DeoptimizeFunction(f); }
|
||||
|
||||
assertEquals(2,
|
||||
f(Object.defineProperty({}, "setterProperty", { set: deopt })));
|
Loading…
Reference in New Issue
Block a user