Skip to content
Browse files

[compiler] Don't assume a HeapConstant context input is a Context.

In a generator containing loops, there are always certain control flow
paths that are impossible, due to the way we represent generators at the
bytecode level.  Unfortunately, the graph builder can't tell that these
paths are impossible.  In combination with dead code, it can then happen
that we build a subgraph (for unreachable code) whose incoming context
is the undefined oddball.  JSContextSpecialization did not expect that.

Bug: chromium:794822
Change-Id: I259be5ae6c5f5adc8fca19c64bf71285ee922b7a
Reviewed-by: Benedikt Meurer <>
Commit-Queue: Georg Neis <>
Cr-Commit-Position: refs/heads/master@{#50129}
  • Loading branch information...
GeorgNeis authored and Commit Bot committed Dec 15, 2017
1 parent 4a7eec5 commit 649ab060c05bc40db696c74ca9ac95093ef9b433
Showing with 24 additions and 2 deletions.
  1. +5 −2 src/compiler/
  2. +19 −0 test/mjsunit/regress/regress-794822.js
@@ -102,8 +102,11 @@ bool IsContextParameter(Node* node) {
MaybeHandle<Context> GetSpecializationContext(Node* node, size_t* distance,
Maybe<OuterContext> maybe_outer) {
switch (node->opcode()) {
case IrOpcode::kHeapConstant:
return Handle<Context>::cast(OpParameter<Handle<HeapObject>>(node));
case IrOpcode::kHeapConstant: {
Handle<Object> object = OpParameter<Handle<HeapObject>>(node);
if (object->IsContext()) return Handle<Context>::cast(object);
case IrOpcode::kParameter: {
OuterContext outer;
if (maybe_outer.To(&outer) && IsContextParameter(node) &&
@@ -0,0 +1,19 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function* opt(arg = () => arg) {
let tmp = opt.x; // LdaNamedProperty
for (;;) {
function inner() { tmp }


0 comments on commit 649ab06

Please sign in to comment.
You can’t perform that action at this time.