Commit 3f0b6c5d authored by mythria's avatar mythria Committed by Commit bot

[Interpreter] Loads accumulator before calling StoreNamedProperty in ForInAssignment.

Fixed a bug in VisitForInAssignment. After visiting the object the value
to be stored was not loaded back to the accumulator. Also added two tests
to check this case.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1571753002

Cr-Commit-Position: refs/heads/master@{#33188}
parent c52767e1
...@@ -851,6 +851,7 @@ void BytecodeGenerator::VisitForInAssignment(Expression* expr, ...@@ -851,6 +851,7 @@ void BytecodeGenerator::VisitForInAssignment(Expression* expr,
builder()->StoreAccumulatorInRegister(value); builder()->StoreAccumulatorInRegister(value);
Register object = VisitForRegisterValue(property->obj()); Register object = VisitForRegisterValue(property->obj());
Handle<String> name = property->key()->AsLiteral()->AsPropertyName(); Handle<String> name = property->key()->AsLiteral()->AsPropertyName();
builder()->LoadAccumulatorWithRegister(value);
builder()->StoreNamedProperty(object, name, feedback_index(slot), builder()->StoreNamedProperty(object, name, feedback_index(slot),
language_mode()); language_mode());
break; break;
......
...@@ -2855,7 +2855,27 @@ TEST(InterpreterForIn) { ...@@ -2855,7 +2855,27 @@ TEST(InterpreterForIn) {
" }\n" " }\n"
" return flags;\n" " return flags;\n"
" }", " }",
0}}; 0},
{"function f() {\n"
" var data = {x:23, y:34};\n"
" var result = 0;\n"
" var o = {};\n"
" var arr = [o];\n"
" for (arr[0].p in data)\n" // This is to test if value is loaded
" result += data[arr[0].p];\n" // back from accumulator before storing
" return result;\n" // named properties.
"}",
57},
{"function f() {\n"
" var data = {x:23, y:34};\n"
" var result = 0;\n"
" var o = {};\n"
" var i = 0;\n"
" for (o[i++] in data)\n" // This is to test if value is loaded
" result += data[o[i-1]];\n" // back from accumulator before
" return result;\n" // storing keyed properties.
"}",
57}};
for (size_t i = 0; i < arraysize(for_in_samples); i++) { for (size_t i = 0; i < arraysize(for_in_samples); i++) {
InterpreterTester tester(handles.main_isolate(), for_in_samples[i].first); InterpreterTester tester(handles.main_isolate(), for_in_samples[i].first);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment