AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[parser] Skipping inner funcs: Fix untrue DCHECK.

Browse Source 
The DCHECK added by https://chromium-review.googlesource.com/461827 was not true
in case we failed to compile the function.

BUG=chromium:708598

Change-Id: I6a542c3ac6281c0549396b4ff0af34ea44450006
Reviewed-on: https://chromium-review.googlesource.com/472826
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44513}
This commit is contained in:
Marja Hölttä 2017-04-10 11:44:53 +02:00 committed by Commit Bot
parent 582921454d
commit 930174c25c
3 changed files with 22 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/objects.cc
View File

@ -12835,10 +12835,6 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
if (function->has_initial_map()) return;
Isolate* isolate = function->GetIsolate();
// The constructor should be compiled for the optimization hints to be
// available.
Compiler::Compile(function, Compiler::CLEAR_EXCEPTION);
// First create a new map with the size and number of in-object properties
// suggested by the function.
InstanceType instance_type;
@ -12849,10 +12845,20 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
} else {
instance_type = JS_OBJECT_TYPE;
}
// The constructor should be compiled for the optimization hints to be
// available.
int expected_nof_properties = 0;
if (function->shared()->is_compiled() ||
Compiler::Compile(function, Compiler::CLEAR_EXCEPTION)) {
DCHECK(function->shared()->is_compiled());
expected_nof_properties = function->shared()->expected_nof_properties();
}
int instance_size;
int in_object_properties;
function->CalculateInstanceSize(instance_type, 0, &instance_size,
&in_object_properties);
CalculateInstanceSizeHelper(instance_type, 0, expected_nof_properties,
&instance_size, &in_object_properties);
Handle<Map> map = isolate->factory()->NewMap(instance_type, instance_size);
@ -13604,16 +13610,6 @@ void JSFunction::CalculateInstanceSizeHelper(InstanceType instance_type,
requested_embedder_fields;
}
void JSFunction::CalculateInstanceSize(InstanceType instance_type,
int requested_embedder_fields,
int* instance_size,
int* in_object_properties) {
DCHECK(shared()->is_compiled());
CalculateInstanceSizeHelper(instance_type, requested_embedder_fields,
shared()->expected_nof_properties(),
instance_size, in_object_properties);
}
void JSFunction::CalculateInstanceSizeForDerivedClass(
Handle<JSFunction> function, InstanceType instance_type,
int requested_embedder_fields, int* instance_size,

3
src/objects.h
View File

@ -6913,9 +6913,6 @@ class JSFunction: public JSObject {
DECLARE_CAST(JSFunction)
// Calculate the instance size and in-object properties count.
void CalculateInstanceSize(InstanceType instance_type,
int requested_embedder_fields, int* instance_size,
int* in_object_properties);
static void CalculateInstanceSizeForDerivedClass(
Handle<JSFunction> function, InstanceType instance_type,
int requested_embedder_fields, int* instance_size,

10
test/mjsunit/regress/regress-708598.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Regression test for hitting a DCHECK; if we just get a syntax error, it's ok.
assertThrows(`function lazy_does_not_compile(x) {
break;
}
new lazy_does_not_compile();`, SyntaxError);