From: mstarzinger <mstarzinger@chromium.org>
Date: Tue, 19 May 2015 16:14:47 +0000 (-0700)
Subject: [turbofan] Fix over-restictive assertion in code generator.
X-Git-Tag: upstream/4.7.83~2554
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=7bd2d3e32ebbfeb439d5e58b5c0f06ab62723ba9;p=platform%2Fupstream%2Fv8.git

[turbofan] Fix over-restictive assertion in code generator.

R=titzer@chromium.org
TEST=mjsunit/regress/regress-crbug-489293
BUG=chromium:489293
LOG=n

Review URL: https://codereview.chromium.org/1142873005

Cr-Commit-Position: refs/heads/master@{#28486}
---

diff --git a/src/compiler/code-generator.cc b/src/compiler/code-generator.cc
index 152c9a4..4cb3d94 100644
--- a/src/compiler/code-generator.cc
+++ b/src/compiler/code-generator.cc
@@ -581,10 +581,7 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
             isolate()->factory()->NewNumberFromInt(constant.ToInt32());
         break;
       case Constant::kFloat64:
-        DCHECK(type == kMachFloat64 || type == kMachAnyTagged ||
-               type == kRepTagged || type == (kTypeNumber | kRepTagged) ||
-               type == (kTypeInt32 | kRepTagged) ||
-               type == (kTypeUint32 | kRepTagged));
+        DCHECK((type & (kRepFloat64 | kRepTagged)) != 0);
         constant_object = isolate()->factory()->NewNumber(constant.ToFloat64());
         break;
       case Constant::kHeapObject:
diff --git a/test/mjsunit/regress/regress-crbug-489293.js b/test/mjsunit/regress/regress-crbug-489293.js
new file mode 100644
index 0000000..38d58e7
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-489293.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f --turbo-deoptimization
+// Flags: --noanalyze-environment-liveness
+
+function f() {
+  var x = 0;
+  for (var y = 0; y < 0; ++y) {
+    x = (x + y) | 0;
+  }
+  return unbound;
+}
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f, ReferenceError);