[turbofan] Fix over-restictive assertion in code generator.

R=titzer@chromium.org
TEST=mjsunit/regress/regress-crbug-489293
BUG=chromium:489293
LOG=n

Review URL: https://codereview.chromium.org/1142873005

Cr-Commit-Position: refs/heads/master@{#28486}

diff --git a/src/compiler/code-generator.cc b/src/compiler/code-generator.cc
index 152c9a4..4cb3d94 100644 (file)
--- a/src/compiler/code-generator.cc
+++ b/src/compiler/code-generator.cc
@@ -581,10 +581,7 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
             isolate()->factory()->NewNumberFromInt(constant.ToInt32());
         break;
       case Constant::kFloat64:
-        DCHECK(type == kMachFloat64 || type == kMachAnyTagged ||
-               type == kRepTagged || type == (kTypeNumber | kRepTagged) ||
-               type == (kTypeInt32 | kRepTagged) ||
-               type == (kTypeUint32 | kRepTagged));
+        DCHECK((type & (kRepFloat64 | kRepTagged)) != 0);
         constant_object = isolate()->factory()->NewNumber(constant.ToFloat64());
         break;
       case Constant::kHeapObject:

diff --git a/test/mjsunit/regress/regress-crbug-489293.js b/test/mjsunit/regress/regress-crbug-489293.js
new file mode 100644 (file)
index 0000000..38d58e7
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-489293.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f --turbo-deoptimization
+// Flags: --noanalyze-environment-liveness
+
+function f() {
+  var x = 0;
+  for (var y = 0; y < 0; ++y) {
+    x = (x + y) | 0;
+  }
+  return unbound;
+}
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f, ReferenceError);