From df986d08b7c1a05dd72a8854ebed6f6338788c37 Mon Sep 17 00:00:00 2001
From: mstarzinger <mstarzinger@chromium.org>
Date: Thu, 5 Feb 2015 04:29:24 -0800
Subject: [PATCH] Fix try-finally for dead AST-branches in TurboFan.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-455644
BUG=chromium:455644
LOG=N

Review URL: https://codereview.chromium.org/880443004

Cr-Commit-Position: refs/heads/master@{#26458}
---
 src/compiler/ast-graph-builder.cc            |  1 -
 src/compiler/ast-graph-builder.h             |  1 +
 src/compiler/control-builders.cc             |  4 ++--
 src/compiler/control-builders.h              |  1 +
 test/mjsunit/regress/regress-crbug-455644.js | 12 ++++++++++++
 5 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 test/mjsunit/regress/regress-crbug-455644.js

diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc
index b3c40b3..5a87e32 100644
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -1194,7 +1194,6 @@ void AstGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
 
   // Create a catch scope that binds the exception.
   Node* exception = try_control.GetExceptionNode();
-  if (exception == NULL) exception = jsgraph()->NullConstant();
   Unique<String> name = MakeUnique(stmt->variable()->name());
   const Operator* op = javascript()->CreateCatchContext(name);
   Node* context = NewNode(op, exception, GetFunctionClosure());
diff --git a/src/compiler/ast-graph-builder.h b/src/compiler/ast-graph-builder.h
index 6da40f4..658e736 100644
--- a/src/compiler/ast-graph-builder.h
+++ b/src/compiler/ast-graph-builder.h
@@ -55,6 +55,7 @@ class AstGraphBuilder : public AstVisitor {
 
   // Get the node that represents the outer function context.
   Node* GetFunctionContext();
+
   // Get the node that represents the outer function closure.
   Node* GetFunctionClosure();
 
diff --git a/src/compiler/control-builders.cc b/src/compiler/control-builders.cc
index 6dba2d3..2ace441 100644
--- a/src/compiler/control-builders.cc
+++ b/src/compiler/control-builders.cc
@@ -151,7 +151,7 @@ void BlockBuilder::EndBlock() {
 
 void TryCatchBuilder::BeginTry() {
   catch_environment_ = environment()->CopyAsUnreachable();
-  catch_environment_->Push(nullptr);
+  catch_environment_->Push(the_hole());
 }
 
 
@@ -178,7 +178,7 @@ void TryCatchBuilder::EndCatch() {
 
 void TryFinallyBuilder::BeginTry() {
   finally_environment_ = environment()->CopyAsUnreachable();
-  finally_environment_->Push(nullptr);
+  finally_environment_->Push(the_hole());
 }
 
 
diff --git a/src/compiler/control-builders.h b/src/compiler/control-builders.h
index d190f61..656b94a 100644
--- a/src/compiler/control-builders.h
+++ b/src/compiler/control-builders.h
@@ -32,6 +32,7 @@ class ControlBuilder {
   Zone* zone() const { return builder_->local_zone(); }
   Environment* environment() { return builder_->environment(); }
   void set_environment(Environment* env) { builder_->set_environment(env); }
+  Node* the_hole() const { return builder_->jsgraph()->TheHoleConstant(); }
 
   Builder* builder_;
 };
diff --git a/test/mjsunit/regress/regress-crbug-455644.js b/test/mjsunit/regress/regress-crbug-455644.js
new file mode 100644
index 0000000..4993d85
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-455644.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function f() {
+  do { return 23; } while(false);
+  with (0) {
+    try {
+      return 42;
+    } finally {}
+  }
+})();
-- 
2.7.4