Return early from BinaryOpIC::Transition when the JS call failed

This avoids an ASSERT failure in Chromium net_unittests.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/49103002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17417 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/ic.cc b/src/ic.cc
index 4bff543..55d7ba9 100644 (file)
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -2306,6 +2306,7 @@ MaybeObject* BinaryOpIC::Transition(Handle<Object> left, Handle<Object> right) {
                          right_type->Maybe(Type::Smi());
 
   Maybe<Handle<Object> > result = stub.Result(left, right, isolate());
+  if (!result.has_value) return Failure::Exception();
 
 #ifdef DEBUG
   if (FLAG_trace_ic) {
@@ -2346,9 +2347,8 @@ MaybeObject* BinaryOpIC::Transition(Handle<Object> left, Handle<Object> right) {
     PatchInlinedSmiCode(address(), DISABLE_INLINED_SMI_CHECK);
   }
 
-  return result.has_value
-      ? static_cast<MaybeObject*>(*result.value)
-      : Failure::Exception();
+  ASSERT(result.has_value);
+  return static_cast<MaybeObject*>(*result.value);
 }