v8/test/mjsunit/regress/regress-crbug-1017159.js
Mike Stanton d5dd2e660c [Turbofan]: Fix error in serializer try ranges with generators
When simulating bytecode, we store the current environment at the
site of the appropriate catch handler when entering a try range.
If the start of the try range is dead, we don't bother to store
an environment. However, generators can create alive regions
inside the try range. At such moments, we should recognize
we're in a try range and store the environment for the handler.

Bug: chromium:1017159
Change-Id: Icccc2ccf530895099bc62b97d9aaec8b97d5f4e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879247
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64929}
2019-11-13 09:28:17 +00:00

28 lines
563 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
function* foo() {
__v_1 = foo.x; // LdaNamedProperty
for (;;) {
try {
yield;
try {
__v_0 == "object";
__v_1[__getRandomProperty()]();
} catch(e) {
print();
}
} catch(e) {
"Caught: " + e;
}
break;
}
};
%PrepareFunctionForOptimization(foo);
%OptimizeFunctionOnNextCall(foo);
foo();