v8/test/mjsunit/regress/regress-crbug-651403.js
leszeks 537c855882 [ignition] BytecodeGraphBuilder: Merge correct environment in try block
Making new nodes inside of exception-handled blocks fiddles around with the
current environment to merge the exception paths. In particular, the current
environment pointer is mutated. This patch ensures that when we merge the fast
and slow paths of the LdaContextLookup, we actually merge the correct
environment and do not accidentally merge the exceptional environment.

BUG=chromium:651394

Review-Url: https://codereview.chromium.org/2379043002
Cr-Commit-Position: refs/heads/master@{#39878}
2016-09-29 15:18:06 +00:00

20 lines
357 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --ignition-staging --turbo --always-opt
function f () {
var x = "";
function g() {
try {
eval('');
return x;
} catch(e) {
}
}
return g();
}
f();