AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[es7] bailout Crankshaft in VisitDoExpression

Browse Source 
For some reason, the DisableCrankshaft() in ast-numbering.cc does not always
prevent crankshaft from happening. Bailout here rather than asserting an
unreachable condition.

BUG=546967, v8:4488
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1414713004

Cr-Commit-Position: refs/heads/master@{#31537}
This commit is contained in:
caitpotter88 2015-10-24 00:06:24 -07:00 committed by Commit bot
parent bb43bf94d0
commit b078960e70
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/crankshaft/hydrogen.cc
View File

@ -5536,7 +5536,10 @@ void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
void HOptimizedGraphBuilder::VisitDoExpression(DoExpression* expr) {
UNREACHABLE();
DCHECK(!HasStackOverflow());
DCHECK(current_block() != NULL);
DCHECK(current_block()->HasPredecessor());
return Bailout(kDoExpression);
}

16
test/mjsunit/harmony/regress/regress-546967.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --harmony-do-expressions --allow-natives-syntax
function func1() {
for (var i = 0; i < 64; ++i) func2();
}
%OptimizeFunctionOnNextCall(func1);
func1();
function func2() {
var v = do {};
}