Commit 537c8558 authored by leszeks's avatar leszeks Committed by Commit bot

[ignition] BytecodeGraphBuilder: Merge correct environment in try block

Making new nodes inside of exception-handled blocks fiddles around with the
current environment to merge the exception paths. In particular, the current
environment pointer is mutated. This patch ensures that when we merge the fast
and slow paths of the LdaContextLookup, we actually merge the correct
environment and do not accidentally merge the exceptional environment.

BUG=chromium:651394

Review-Url: https://codereview.chromium.org/2379043002
Cr-Commit-Position: refs/heads/master@{#39878}
parent 497af7fc
......@@ -906,18 +906,16 @@ void BytecodeGraphBuilder::BuildLdaLookupContextSlot(TypeofMode typeof_mode) {
extension_slot, jsgraph()->TheHoleConstant());
NewBranch(check_no_extension);
Environment* false_environment = environment();
Environment* true_environment = environment()->CopyForConditional();
{
set_environment(false_environment);
NewIfFalse();
// If there is an extension, merge into the slow path.
if (slow_environment == nullptr) {
slow_environment = false_environment;
slow_environment = environment();
NewMerge();
} else {
slow_environment->Merge(false_environment);
slow_environment->Merge(environment());
}
}
......@@ -956,7 +954,7 @@ void BytecodeGraphBuilder::BuildLdaLookupContextSlot(TypeofMode typeof_mode) {
environment()->BindAccumulator(value, &states);
}
fast_environment->Merge(slow_environment);
fast_environment->Merge(environment());
set_environment(fast_environment);
}
......
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --ignition-staging --turbo --always-opt
x = "";
function f () {
function g() {
try {
eval('');
return x;
} catch(e) {
}
}
return g();
}
f();
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --ignition-staging --turbo --always-opt
function f () {
var x = "";
function g() {
try {
eval('');
return x;
} catch(e) {
}
}
return g();
}
f();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment