[turbofan] Make sure an inlined call is not resurrected and inlined again.

BUG=chromium:714483

Review-Url: https://codereview.chromium.org/2833423004
Cr-Commit-Position: refs/heads/master@{#44830}
This commit is contained in:
jarin 2017-04-25 01:10:32 -07:00 committed by Commit bot
parent ea89c3fd66
commit d081a6f692
3 changed files with 31 additions and 1 deletions

View File

@ -270,6 +270,9 @@ Reduction JSInliningHeuristic::InlineCandidate(Candidate const& candidate) {
Node* node = calls[i];
Reduction const reduction = inliner_.ReduceJSCall(node);
if (reduction.Changed()) {
// Killing the call node is not strictly necessary, but it is safer to
// make sure we do not resurrect the node.
node->Kill();
cumulative_count_ += function->shared()->ast_node_count();
}
}

View File

@ -218,7 +218,8 @@ Reduction JSInliner::InlineCall(Node* call, Node* new_target, Node* context,
ReplaceWithValue(call, value_output, effect_output, control_output);
return Changed(value_output);
} else {
ReplaceWithValue(call, call, call, jsgraph()->Dead());
ReplaceWithValue(call, jsgraph()->Dead(), jsgraph()->Dead(),
jsgraph()->Dead());
return Changed(call);
}
}

View File

@ -0,0 +1,26 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function C1() { }
C1.prototype.f = function () { return 1; }
function C2() { }
C2.prototype.f = function () { throw 2; }
var o1 = new C1();
var o2 = new C2();
function foo(o) {
return o.f();
}
foo(o1);
try { foo(o2); } catch(e) {}
foo(o1);
try { foo(o2); } catch(e) {}
%OptimizeFunctionOnNextCall(foo);
assertEquals(1, foo(o1));
assertThrows(() => foo(o2));