AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix eager bailout point after comma expression.

Browse Source 
This ensures no eager bailout point is emitted after a comma expression
in test context where the right-hand side omitted an eager bailout point
as well. This is to stay in sync with full-codegen.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624919
BUG=chromium:624919

Review-Url: https://codereview.chromium.org/2113893004
Cr-Commit-Position: refs/heads/master@{#37475}
This commit is contained in:
mstarzinger 2016-07-01 02:50:36 -07:00 committed by Commit bot
parent 9f5f31800e
commit 920bc17c97
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/ast-graph-builder.cc
View File

@ -3052,6 +3052,10 @@ void AstGraphBuilder::VisitNot(UnaryOperation* expr) {
void AstGraphBuilder::VisitComma(BinaryOperation* expr) {
VisitForEffect(expr->left());
Visit(expr->right());
// Skip plugging AST evaluation contexts of the test kind. This is to stay in
// sync with full codegen which doesn't prepare the proper bailout point (see
// the implementation of FullCodeGenerator::VisitForControl).
if (ast_context()->IsTest()) return;
ast_context()->ReplaceValue(expr);
}

14
test/mjsunit/regress/regress-crbug-624919.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(a, b, c, d, e) {
if (a && (b, c ? d() : e())) return 0;
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();