[turbofan] Fix --turbo-osr for OSRing into inner loop inside for-in.

R=mstarzinger@chromium.org
BUG=chromium:462775
LOG=Y

Review URL: https://codereview.chromium.org/988423003

Cr-Commit-Position: refs/heads/master@{#27088}

diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc
index 96809fc2dff053b92817c2ffd0bdf7ad66a819d5..5c874bc8b52cda3ada0456241050a20aadc50b75 100644 (file)
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -1194,7 +1194,9 @@ void AstGraphBuilder::VisitForInBody(ForInStatement* stmt) {
   // Bind value and do loop body.
   VisitForInAssignment(stmt->each(), value, stmt->AssignmentId());
   VisitIterationBody(stmt, &for_loop);
+  index = environment()->Peek(0);
   for_loop.EndBody();
+
   // Inc counter and continue.
   Node* index_inc =
       NewNode(javascript()->Add(), index, jsgraph()->OneConstant());

diff --git a/test/mjsunit/compiler/osr-forin-nested.js b/test/mjsunit/compiler/osr-forin-nested.js
new file mode 100644 (file)
index 0000000..ad55b30
--- /dev/null
+++ b/test/mjsunit/compiler/osr-forin-nested.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-osr --allow-natives-syntax
+
+function test(e, f, v) {
+  assertEquals(e, f(v));
+  assertEquals(e, f(v));
+  assertEquals(e, f(v));
+}
+
+function foo(t) {
+  for (var x in t) {
+    for (var i = 0; i < 2; i++) {
+      %OptimizeOsr();
+    }
+  }
+  return 5;
+}
+
+test(5, foo, {x:20});
+
+function bar(t) {
+  var sum = 0;
+  for (var x in t) {
+    for (var i = 0; i < 2; i++) {
+      %OptimizeOsr();
+      sum += t[x];
+    }
+  }
+  return sum;
+}
+
+test(62, bar, {x:20,y:11});