diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc index c86d7035a7..be6c358617 100644 --- a/src/compiler/ast-graph-builder.cc +++ b/src/compiler/ast-graph-builder.cc @@ -3734,7 +3734,7 @@ Node* AstGraphBuilder::BuildToBoolean(Node* input, TypeFeedbackId feedback_id) { Node* AstGraphBuilder::BuildToName(Node* input, BailoutId bailout_id) { if (Node* node = TryFastToName(input)) return node; Node* name = NewNode(javascript()->ToName(), input); - PrepareFrameState(name, bailout_id); + PrepareFrameState(name, bailout_id, OutputFrameStateCombine::Push()); return name; } diff --git a/src/full-codegen/full-codegen.cc b/src/full-codegen/full-codegen.cc index f98c3096a6..bbbc319ff9 100644 --- a/src/full-codegen/full-codegen.cc +++ b/src/full-codegen/full-codegen.cc @@ -1066,7 +1066,7 @@ void FullCodeGenerator::EmitPropertyKey(ObjectLiteralProperty* property, BailoutId bailout_id) { VisitForStackValue(property->key()); CallRuntimeWithOperands(Runtime::kToName); - PrepareForBailoutForId(bailout_id, BailoutState::NO_REGISTERS); + PrepareForBailoutForId(bailout_id, BailoutState::TOS_REGISTER); PushOperand(result_register()); } diff --git a/test/mjsunit/regress/regress-crbug-627828.js b/test/mjsunit/regress/regress-crbug-627828.js new file mode 100644 index 0000000000..75ff77cb64 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-627828.js @@ -0,0 +1,40 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +(function TestDeoptFromCopmputedNameInObjectLiteral() { + function f() { + var o = { + toString: function() { + %DeoptimizeFunction(f); + return "x"; + } + }; + return { [o]() { return 23 } }; + } + assertEquals(23, f().x()); + assertEquals(23, f().x()); + %OptimizeFunctionOnNextCall(f); + assertEquals(23, f().x()); +})(); + +(function TestDeoptFromCopmputedNameInClassLiteral() { + function g() { + var o = { + toString: function() { + %DeoptimizeFunction(g); + return "y"; + } + }; + class C { + [o]() { return 42 }; + } + return new C(); + } + assertEquals(42, g().y()); + assertEquals(42, g().y()); + %OptimizeFunctionOnNextCall(g); + assertEquals(42, g().y()); +})();