Add missing FrameState to JSToName nodes.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-451770
BUG=chromium:451770
LOG=N

Review URL: https://codereview.chromium.org/880963002

Cr-Commit-Position: refs/heads/master@{#26305}

diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index d18390d97a2889962c6d51cfb672dcf7efb78cae..dc663d941681584f728d5907300c6b5fb70b4117 100644 (file)
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -1810,7 +1810,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2550,7 +2550,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
       __ ldr(scratch, MemOperand(sp, 0));  // prototype
     }
     __ push(scratch);
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/src/arm64/full-codegen-arm64.cc b/src/arm64/full-codegen-arm64.cc
index c871d03b3aa73e01482c6ec293b58558b04ad7a9..802179b687ea4bd2007a375a372a86402b7149cd 100644 (file)
--- a/src/arm64/full-codegen-arm64.cc
+++ b/src/arm64/full-codegen-arm64.cc
@@ -1791,7 +1791,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2247,7 +2247,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
       __ Peek(scratch, 0);  // prototype
     }
     __ Push(scratch);
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/src/ast-numbering.cc b/src/ast-numbering.cc
index fd74b2e700af424ca554e088b49a964b805a6454..a2bc65827d9ded4afdc131c0467d2dab6d0006f4 100644 (file)
--- a/src/ast-numbering.cc
+++ b/src/ast-numbering.cc
@@ -441,7 +441,7 @@ void AstNumberingVisitor::VisitForStatement(ForStatement* node) {
 void AstNumberingVisitor::VisitClassLiteral(ClassLiteral* node) {
   IncrementNodeCount();
   DisableOptimization(kClassLiteral);
-  node->set_base_id(ReserveIdRange(ClassLiteral::num_ids()));
+  node->set_base_id(ReserveIdRange(node->num_ids()));
   if (node->extends()) Visit(node->extends());
   if (node->constructor()) Visit(node->constructor());
   if (node->class_variable_proxy()) {
@@ -455,7 +455,7 @@ void AstNumberingVisitor::VisitClassLiteral(ClassLiteral* node) {
 
 void AstNumberingVisitor::VisitObjectLiteral(ObjectLiteral* node) {
   IncrementNodeCount();
-  node->set_base_id(ReserveIdRange(ObjectLiteral::num_ids()));
+  node->set_base_id(ReserveIdRange(node->num_ids()));
   for (int i = 0; i < node->properties()->length(); i++) {
     VisitObjectLiteralProperty(node->properties()->at(i));
   }

diff --git a/src/ast.h b/src/ast.h
index 4903928456dd540cce2cfbdae6f17e3c058b731e..6da9a5f57bee1393b83985601b37e9c07112dbfd 100644 (file)
--- a/src/ast.h
+++ b/src/ast.h
@@ -1530,7 +1530,12 @@ class ObjectLiteral FINAL : public MaterializedLiteral {
 
   BailoutId CreateLiteralId() const { return BailoutId(local_id(0)); }
 
-  static int num_ids() { return parent_num_ids() + 1; }
+  // Return an AST id for a property that is used in simulate instructions.
+  BailoutId GetIdForProperty(int i) { return BailoutId(local_id(i + 1)); }
+
+  // Unlike other AST nodes, this number of bailout IDs allocated for an
+  // ObjectLiteral can vary, so num_ids() is not a static method.
+  int num_ids() const { return parent_num_ids() + 1 + properties()->length(); }
 
  protected:
   ObjectLiteral(Zone* zone, ZoneList<Property*>* properties, int literal_index,
@@ -2641,11 +2646,17 @@ class ClassLiteral FINAL : public Expression {
   int start_position() const { return position(); }
   int end_position() const { return end_position_; }
 
-  static int num_ids() { return parent_num_ids() + 3; }
   BailoutId EntryId() const { return BailoutId(local_id(0)); }
   BailoutId DeclsId() const { return BailoutId(local_id(1)); }
   BailoutId ExitId() { return BailoutId(local_id(2)); }
 
+  // Return an AST id for a property that is used in simulate instructions.
+  BailoutId GetIdForProperty(int i) { return BailoutId(local_id(i + 3)); }
+
+  // Unlike other AST nodes, this number of bailout IDs allocated for an
+  // ClassLiteral can vary, so num_ids() is not a static method.
+  int num_ids() const { return parent_num_ids() + 3 + properties()->length(); }
+
  protected:
   ClassLiteral(Zone* zone, const AstRawString* name, Scope* scope,
                VariableProxy* class_variable_proxy, Expression* extends,

diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc
index 28378a59a5d2fa6372e2bc73e49dd8953dfd8f13..d37ca7eab2183fa1d97298f3ca764e680af9d2b1 100644 (file)
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -899,7 +899,8 @@ void AstGraphBuilder::VisitClassLiteralContents(ClassLiteral* expr) {
     environment()->Push(property->is_static() ? literal : proto);
 
     VisitForValue(property->key());
-    environment()->Push(BuildToName(environment()->Pop()));
+    environment()->Push(
+        BuildToName(environment()->Pop(), expr->GetIdForProperty(i)));
     VisitForValue(property->value());
     Node* value = environment()->Pop();
     Node* key = environment()->Pop();
@@ -1131,7 +1132,8 @@ void AstGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
 
     environment()->Push(literal);  // Duplicate receiver.
     VisitForValue(property->key());
-    environment()->Push(BuildToName(environment()->Pop()));
+    environment()->Push(BuildToName(environment()->Pop(),
+                                    expr->GetIdForProperty(property_index)));
     // TODO(mstarzinger): For ObjectLiteral::Property::PROTOTYPE the key should
     // not be on the operand stack while the value is being evaluated. Come up
     // with a repro for this and fix it. Also find a nice way to do so. :)
@@ -2324,11 +2326,13 @@ Node* AstGraphBuilder::BuildToBoolean(Node* input) {
 }
 
 
-Node* AstGraphBuilder::BuildToName(Node* input) {
+Node* AstGraphBuilder::BuildToName(Node* input, BailoutId bailout_id) {
   // TODO(turbofan): Possible optimization is to NOP on name constants. But the
   // same caveat as with BuildToBoolean applies, and it should be factored out
   // into a JSOperatorReducer.
-  return NewNode(javascript()->ToName(), input);
+  Node* name = NewNode(javascript()->ToName(), input);
+  PrepareFrameState(name, bailout_id);
+  return name;
 }
 
 

diff --git a/src/compiler/ast-graph-builder.h b/src/compiler/ast-graph-builder.h
index 98d7fb63049b3d79415f3297775ff61edd2f94a7..6830c984461cf35f68dab8f0e17c283d79c29757 100644 (file)
--- a/src/compiler/ast-graph-builder.h
+++ b/src/compiler/ast-graph-builder.h
@@ -99,7 +99,7 @@ class AstGraphBuilder : public StructuredGraphBuilder, public AstVisitor {
 
   // Builders for automatic type conversion.
   Node* BuildToBoolean(Node* value);
-  Node* BuildToName(Node* value);
+  Node* BuildToName(Node* value, BailoutId bailout_id);
 
   // Builders for error reporting at runtime.
   Node* BuildThrowReferenceError(Variable* var, BailoutId bailout_id);

diff --git a/src/compiler/operator-properties.cc b/src/compiler/operator-properties.cc
index 319ed977d97a32ae66bb3e241115595e6a978038..81299e34ffe830adce4ffa155cf126e0a962a01f 100644 (file)
--- a/src/compiler/operator-properties.cc
+++ b/src/compiler/operator-properties.cc
@@ -70,6 +70,7 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     // Conversions
     case IrOpcode::kJSToObject:
     case IrOpcode::kJSToNumber:
+    case IrOpcode::kJSToName:
 
     // Properties
     case IrOpcode::kJSLoadNamed:

diff --git a/src/full-codegen.cc b/src/full-codegen.cc
index 42941d88abcfcf2bb948ca57959fcf4b6e59b9fa..cc32c3e31fa50b5fd8e3601d69869dcc4187a56e 100644 (file)
--- a/src/full-codegen.cc
+++ b/src/full-codegen.cc
@@ -1211,9 +1211,11 @@ void FullCodeGenerator::EmitUnwindBeforeReturn() {
 }
 
 
-void FullCodeGenerator::EmitPropertyKey(ObjectLiteralProperty* property) {
+void FullCodeGenerator::EmitPropertyKey(ObjectLiteralProperty* property,
+                                        BailoutId bailout_id) {
   VisitForStackValue(property->key());
   __ InvokeBuiltin(Builtins::TO_NAME, CALL_FUNCTION);
+  PrepareForBailoutForId(bailout_id, NO_REGISTERS);
   __ Push(result_register());
 }
 

diff --git a/src/full-codegen.h b/src/full-codegen.h
index cc24bb8070a1d20100a5c0adc57351b89a00ba7b..2c12da4c2c66e12956574fc68150b5d2602eb853 100644 (file)
--- a/src/full-codegen.h
+++ b/src/full-codegen.h
@@ -580,7 +580,7 @@ class FullCodeGenerator: public AstVisitor {
   void EmitClassDefineProperties(ClassLiteral* lit);
 
   // Pushes the property key as a Name on the stack.
-  void EmitPropertyKey(ObjectLiteralProperty* property);
+  void EmitPropertyKey(ObjectLiteralProperty* property, BailoutId bailout_id);
 
   // Apply the compound assignment operator. Expects the left operand on top
   // of the stack and the right one in the accumulator.

diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index db405bc0d6b99773bdd0493e5923172fc5b28a83..3873c5592d69862ef71a15db095fbdfa115b4724 100644 (file)
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -1732,7 +1732,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2463,7 +2463,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
     } else {
       __ push(Operand(esp, 0));  // prototype
     }
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/src/mips/full-codegen-mips.cc b/src/mips/full-codegen-mips.cc
index 25ec2b578cdfb3c8077d4d71d1df068da1aefaf0..2aebbba1d338b007562a4ffee9026feaaa88f74b 100644 (file)
--- a/src/mips/full-codegen-mips.cc
+++ b/src/mips/full-codegen-mips.cc
@@ -1795,7 +1795,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2528,7 +2528,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
       __ lw(scratch, MemOperand(sp, 0));  // prototype
     }
     __ push(scratch);
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/src/mips64/full-codegen-mips64.cc b/src/mips64/full-codegen-mips64.cc
index d639c10f001cdcf0339960456b2af3da93749d2e..733ff81f8e759f7ea560755f3229e1645911383a 100644 (file)
--- a/src/mips64/full-codegen-mips64.cc
+++ b/src/mips64/full-codegen-mips64.cc
@@ -1792,7 +1792,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2525,7 +2525,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
       __ ld(scratch, MemOperand(sp, 0));  // prototype
     }
     __ push(scratch);
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/src/x64/full-codegen-x64.cc b/src/x64/full-codegen-x64.cc
index b7668602f7660e372121ce07a58a98b283a53eb3..2fce910cc049de37e8667aaf4a6ae2377ebb8bd3 100644 (file)
--- a/src/x64/full-codegen-x64.cc
+++ b/src/x64/full-codegen-x64.cc
@@ -1766,7 +1766,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2462,7 +2462,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
     } else {
       __ Push(Operand(rsp, 0));  // prototype
     }
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/src/x87/full-codegen-x87.cc b/src/x87/full-codegen-x87.cc
index 13a67925129263989518dd6de65f1aecdbb1fa13..ed917433a69e4a3d568d10a042ebbfbc0c20a816 100644 (file)
--- a/src/x87/full-codegen-x87.cc
+++ b/src/x87/full-codegen-x87.cc
@@ -1721,7 +1721,7 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         __ Drop(2);
       }
     } else {
-      EmitPropertyKey(property);
+      EmitPropertyKey(property, expr->GetIdForProperty(property_index));
       VisitForStackValue(value);
 
       switch (property->kind()) {
@@ -2450,7 +2450,7 @@ void FullCodeGenerator::EmitClassDefineProperties(ClassLiteral* lit) {
     } else {
       __ push(Operand(esp, 0));  // prototype
     }
-    EmitPropertyKey(property);
+    EmitPropertyKey(property, lit->GetIdForProperty(i));
     VisitForStackValue(value);
     EmitSetHomeObjectIfNeeded(value, 2);
 

diff --git a/test/mjsunit/regress/regress-crbug-451770.js b/test/mjsunit/regress/regress-crbug-451770.js
new file mode 100644 (file)
index 0000000..942814a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-451770.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-computed-property-names --harmony-classes --harmony-sloppy
+
+assertThrows(function f() {
+  var t = { toString: function() { throw new Error(); } };
+  var o = { [t]: 23 };
+}, Error);
+
+assertThrows(function f() {
+  var t = { toString: function() { throw new Error(); } };
+  class C { [t]() { return 23; } };
+}, Error);

diff --git a/test/unittests/compiler/js-operator-unittest.cc b/test/unittests/compiler/js-operator-unittest.cc
index 7d4890675176b4dc54b37af3a61a6e49c9a38417..fd70f55bb165a75e1a7cc2e37685bae7d2f41fa5 100644 (file)
--- a/test/unittests/compiler/js-operator-unittest.cc
+++ b/test/unittests/compiler/js-operator-unittest.cc
@@ -68,7 +68,7 @@ const SharedOperator kSharedOperators[] = {
     SHARED(ToBoolean, Operator::kPure, 1, 0, 0, 0, 1, 0),
     SHARED(ToNumber, Operator::kNoProperties, 1, 1, 1, 1, 1, 1),
     SHARED(ToString, Operator::kNoProperties, 1, 0, 1, 1, 1, 1),
-    SHARED(ToName, Operator::kNoProperties, 1, 0, 1, 1, 1, 1),
+    SHARED(ToName, Operator::kNoProperties, 1, 1, 1, 1, 1, 1),
     SHARED(ToObject, Operator::kNoProperties, 1, 1, 1, 1, 1, 1),
     SHARED(Yield, Operator::kNoProperties, 1, 0, 1, 1, 1, 1),
     SHARED(Create, Operator::kEliminatable, 0, 0, 1, 1, 1, 1),