[turbofan] Handle stack overflow exceptions in JSInliner.

R=bmeurer@chromium.org
BUG=chromium:527364
LOG=n

Review URL: https://codereview.chromium.org/1322203005

Cr-Commit-Position: refs/heads/master@{#30651}

diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 03e6384..d676c9e 100644 (file)
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -15,6 +15,7 @@
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
 #include "src/full-codegen/full-codegen.h"
+#include "src/isolate-inl.h"
 #include "src/parser.h"
 #include "src/rewriter.h"
 #include "src/scopes.h"
@@ -296,8 +297,22 @@ Reduction JSInliner::Reduce(Node* node) {
   CompilationInfo info(&parse_info);
   if (info_->is_deoptimization_enabled()) info.MarkAsDeoptimizationEnabled();
 
-  if (!Compiler::ParseAndAnalyze(info.parse_info())) return NoChange();
-  if (!Compiler::EnsureDeoptimizationSupport(&info)) return NoChange();
+  if (!Compiler::ParseAndAnalyze(info.parse_info())) {
+    TRACE("Not inlining %s into %s because parsing failed\n",
+          function->shared()->DebugName()->ToCString().get(),
+          info_->shared_info()->DebugName()->ToCString().get());
+    if (info_->isolate()->has_pending_exception()) {
+      info_->isolate()->clear_pending_exception();
+    }
+    return NoChange();
+  }
+
+  if (!Compiler::EnsureDeoptimizationSupport(&info)) {
+    TRACE("Not inlining %s into %s because deoptimization support failed\n",
+          function->shared()->DebugName()->ToCString().get(),
+          info_->shared_info()->DebugName()->ToCString().get());
+    return NoChange();
+  }
 
   if (info.scope()->arguments() != NULL && is_sloppy(info.language_mode())) {
     // For now do not inline functions that use their arguments array.

diff --git a/test/mjsunit/regress/regress-crbug-527364.js b/test/mjsunit/regress/regress-crbug-527364.js
new file mode 100644 (file)
index 0000000..914bed0
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-527364.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100 --allow-natives-syntax
+
+function module() {
+  "use asm";
+  var abs = Math.abs;
+  function f() {
+    return +abs();
+  }
+  return { f:f };
+}
+
+function run_close_to_stack_limit(f) {
+  try {
+    run_close_to_stack_limit(f);
+    f();
+  } catch(e) {
+  }
+}
+
+var boom = module().f;
+%OptimizeFunctionOnNextCall(boom)
+run_close_to_stack_limit(boom);