[parser] Skipping inner funcs: Fix untrue DCHECK.
The DCHECK added by https://chromium-review.googlesource.com/461827 was not true in case we failed to compile the function. BUG=chromium:708598 Change-Id: I6a542c3ac6281c0549396b4ff0af34ea44450006 Reviewed-on: https://chromium-review.googlesource.com/472826 Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#44513}
This commit is contained in:
parent
582921454d
commit
930174c25c
@ -12835,10 +12835,6 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
|
|||||||
if (function->has_initial_map()) return;
|
if (function->has_initial_map()) return;
|
||||||
Isolate* isolate = function->GetIsolate();
|
Isolate* isolate = function->GetIsolate();
|
||||||
|
|
||||||
// The constructor should be compiled for the optimization hints to be
|
|
||||||
// available.
|
|
||||||
Compiler::Compile(function, Compiler::CLEAR_EXCEPTION);
|
|
||||||
|
|
||||||
// First create a new map with the size and number of in-object properties
|
// First create a new map with the size and number of in-object properties
|
||||||
// suggested by the function.
|
// suggested by the function.
|
||||||
InstanceType instance_type;
|
InstanceType instance_type;
|
||||||
@ -12849,10 +12845,20 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
|
|||||||
} else {
|
} else {
|
||||||
instance_type = JS_OBJECT_TYPE;
|
instance_type = JS_OBJECT_TYPE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// The constructor should be compiled for the optimization hints to be
|
||||||
|
// available.
|
||||||
|
int expected_nof_properties = 0;
|
||||||
|
if (function->shared()->is_compiled() ||
|
||||||
|
Compiler::Compile(function, Compiler::CLEAR_EXCEPTION)) {
|
||||||
|
DCHECK(function->shared()->is_compiled());
|
||||||
|
expected_nof_properties = function->shared()->expected_nof_properties();
|
||||||
|
}
|
||||||
|
|
||||||
int instance_size;
|
int instance_size;
|
||||||
int in_object_properties;
|
int in_object_properties;
|
||||||
function->CalculateInstanceSize(instance_type, 0, &instance_size,
|
CalculateInstanceSizeHelper(instance_type, 0, expected_nof_properties,
|
||||||
&in_object_properties);
|
&instance_size, &in_object_properties);
|
||||||
|
|
||||||
Handle<Map> map = isolate->factory()->NewMap(instance_type, instance_size);
|
Handle<Map> map = isolate->factory()->NewMap(instance_type, instance_size);
|
||||||
|
|
||||||
@ -13604,16 +13610,6 @@ void JSFunction::CalculateInstanceSizeHelper(InstanceType instance_type,
|
|||||||
requested_embedder_fields;
|
requested_embedder_fields;
|
||||||
}
|
}
|
||||||
|
|
||||||
void JSFunction::CalculateInstanceSize(InstanceType instance_type,
|
|
||||||
int requested_embedder_fields,
|
|
||||||
int* instance_size,
|
|
||||||
int* in_object_properties) {
|
|
||||||
DCHECK(shared()->is_compiled());
|
|
||||||
CalculateInstanceSizeHelper(instance_type, requested_embedder_fields,
|
|
||||||
shared()->expected_nof_properties(),
|
|
||||||
instance_size, in_object_properties);
|
|
||||||
}
|
|
||||||
|
|
||||||
void JSFunction::CalculateInstanceSizeForDerivedClass(
|
void JSFunction::CalculateInstanceSizeForDerivedClass(
|
||||||
Handle<JSFunction> function, InstanceType instance_type,
|
Handle<JSFunction> function, InstanceType instance_type,
|
||||||
int requested_embedder_fields, int* instance_size,
|
int requested_embedder_fields, int* instance_size,
|
||||||
|
@ -6913,9 +6913,6 @@ class JSFunction: public JSObject {
|
|||||||
DECLARE_CAST(JSFunction)
|
DECLARE_CAST(JSFunction)
|
||||||
|
|
||||||
// Calculate the instance size and in-object properties count.
|
// Calculate the instance size and in-object properties count.
|
||||||
void CalculateInstanceSize(InstanceType instance_type,
|
|
||||||
int requested_embedder_fields, int* instance_size,
|
|
||||||
int* in_object_properties);
|
|
||||||
static void CalculateInstanceSizeForDerivedClass(
|
static void CalculateInstanceSizeForDerivedClass(
|
||||||
Handle<JSFunction> function, InstanceType instance_type,
|
Handle<JSFunction> function, InstanceType instance_type,
|
||||||
int requested_embedder_fields, int* instance_size,
|
int requested_embedder_fields, int* instance_size,
|
||||||
|
10
test/mjsunit/regress/regress-708598.js
Normal file
10
test/mjsunit/regress/regress-708598.js
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
// Copyright 2017 the V8 project authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style license that can be
|
||||||
|
// found in the LICENSE file.
|
||||||
|
|
||||||
|
// Regression test for hitting a DCHECK; if we just get a syntax error, it's ok.
|
||||||
|
|
||||||
|
assertThrows(`function lazy_does_not_compile(x) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
new lazy_does_not_compile();`, SyntaxError);
|
Loading…
Reference in New Issue
Block a user