• bmeurer's avatar
    [turbofan] Fix missing bailout point before calls. · 6040d5c0
    bmeurer authored
    In order to properly (lazy) bailout when converting the receiver for
    sloppy mode functions (using the newly added JSConvertReceiver
    operator), we need to have a bailout location right before every call
    (also right before every %_Call and %_CallFunction), otherwise if the
    JSConvertReceiver just reuses the lazy bailout frame state from the
    JSCallFunction node, it will skip the whole function in case of lazy
    bailout.
    
    Note it should be impossible to trigger this currently because we do not
    yet support AllocationSite code dependencies in TurboFan, which can
    trigger this kind of lazy bailout; therefore it's not possible to write
    a regression test (yet).
    
    R=yangguo@chromium.org
    BUG=v8:4493
    LOG=n
    
    Review URL: https://codereview.chromium.org/1425883004
    
    Cr-Commit-Position: refs/heads/master@{#31668}
    6040d5c0
operator-properties.cc 4.15 KB