Fix a bug in deoptimization environments.

src/hydrogen.h

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 383 matching lines @@
   DISALLOW_COPY_AND_ASSIGN(HGraph);
 };
 
 
 class HEnvironment: public ZoneObject {
  public:
   HEnvironment(HEnvironment* outer,
                Scope* scope,
                Handle<JSFunction> closure);
 
+  // Simple accessors.
+  Handle<JSFunction> closure() const { return closure_; }
+  const ZoneList<HValue*>* values() const { return &values_; }
+  const ZoneList<int>* assigned_variables() const {
+    return &assigned_variables_;
+  }
+  int parameter_count() const { return parameter_count_; }
+  int local_count() const { return local_count_; }
+  HEnvironment* outer() const { return outer_; }
+  int pop_count() const { return pop_count_; }
+  int push_count() const { return push_count_; }
+
+  int ast_id() const { return ast_id_; }
+  void set_ast_id(int id) { ast_id_ = id; }
+
+  int length() const { return values_.length(); }
+
   void Bind(Variable* variable, HValue* value) {
     Bind(IndexFor(variable), value);
-
-    if (FLAG_trace_environment) {
-      PrintF("Slot index=%d name=%s\n",
-             variable->AsSlot()->index(),
-             *variable->name()->ToCString());
-    }
   }
 
-  void Bind(int index, HValue* value) {
-    ASSERT(value != NULL);
-    if (!assigned_variables_.Contains(index)) {
-      assigned_variables_.Add(index);
-    }
-    values_[index] = value;
-  }
+  void Bind(int index, HValue* value);
 
   HValue* Lookup(Variable* variable) const {
     return Lookup(IndexFor(variable));
   }
+
   HValue* Lookup(int index) const {
     HValue* result = values_[index];
     ASSERT(result != NULL);
     return result;
   }
 
   void Push(HValue* value) {
     ASSERT(value != NULL);
     ++push_count_;
     values_.Add(value);
   }
 
-  HValue* Top() const { return ExpressionStackAt(0); }
-
-  HValue* ExpressionStackAt(int index_from_top) const {
-    int index = values_.length() - index_from_top - 1;
-    ASSERT(IsExpressionStackIndex(index));
-    return values_[index];
-  }
-
-  void SetExpressionStackAt(int index_from_top, HValue* value) {
-    int index = values_.length() - index_from_top - 1;
-    ASSERT(IsExpressionStackIndex(index));
-    values_[index] = value;
-  }
-
   HValue* Pop() {
-    ASSERT(!IsExpressionStackEmpty());
+    ASSERT(!ExpressionStackIsEmpty());
     if (push_count_ > 0) {
       --push_count_;
-      ASSERT(push_count_ >= 0);
     } else {
       ++pop_count_;
     }
     return values_.RemoveLast();
   }
 
-  void Drop(int count) {
-    for (int i = 0; i < count; ++i) {
-      Pop();
-    }
+  void Drop(int count);
+
+  HValue* Top() const { return ExpressionStackAt(0); }
+
+  HValue* ExpressionStackAt(int index_from_top) const {
+    int index = length() - index_from_top - 1;
+    ASSERT(HasExpressionAt(index));
+    return values_[index];
   }
 
-  Handle<JSFunction> closure() const { return closure_; }
+  void SetExpressionStackAt(int index_from_top, HValue* value);
 
-  // ID of the original AST node to identify deoptimization points.
-  int ast_id() const { return ast_id_; }
-  void set_ast_id(int id) { ast_id_ = id; }
-
-  const ZoneList<HValue*>* values() const { return &values_; }
-  const ZoneList<int>* assigned_variables() const {
-    return &assigned_variables_;
-  }
-  int parameter_count() const { return parameter_count_; }
-  int local_count() const { return local_count_; }
-  int push_count() const { return push_count_; }
-  int pop_count() const { return pop_count_; }
-  int total_count() const { return values_.length(); }
-  HEnvironment* outer() const { return outer_; }
   HEnvironment* Copy() const;
   HEnvironment* CopyWithoutHistory() const;
   HEnvironment* CopyAsLoopHeader(HBasicBlock* block) const;
 
   // Create an "inlined version" of this environment, where the original
   // environment is the outer environment but the top expression stack
   // elements are moved to an inner environment as parameters. If
   // is_speculative, the argument values are expected to be PushArgument
   // instructions, otherwise they are the actual values.
   HEnvironment* CopyForInlining(Handle<JSFunction> target,
                                 FunctionLiteral* function,
                                 bool is_speculative,
                                 HConstant* undefined) const;
 
   void AddIncomingEdge(HBasicBlock* block, HEnvironment* other);
+
   void ClearHistory() {
     pop_count_ = 0;
     push_count_ = 0;
     assigned_variables_.Clear();
   }
+
   void SetValueAt(int index, HValue* value) {
-    ASSERT(index < total_count());
+    ASSERT(index < length());
     values_[index] = value;
   }
 
   void PrintTo(StringStream* stream);
   void PrintToStd();
 
  private:
   explicit HEnvironment(const HEnvironment* other);
 
-  bool IsExpressionStackIndex(int index) const {
-    return index >= parameter_count_ + local_count_;
-  }
-  bool IsExpressionStackEmpty() const {
-    int length = values_.length();
-    int first_expression = parameter_count() + local_count();
-    ASSERT(length >= first_expression);
-    return length == first_expression;
-  }
+  // True if index is included in the expression stack part of the environment.
+  bool HasExpressionAt(int index) const;
+
+  bool ExpressionStackIsEmpty() const;
+
   void Initialize(int parameter_count, int local_count, int stack_height);
   void Initialize(const HEnvironment* other);
-  int VariableToIndex(Variable* var);
-  int IndexFor(Variable* variable) const;
+
+  // Map a variable to an environment index.  Parameter indices are shifted
+  // by 1 (receiver is parameter index -1 but environment index 0).
+  // Stack-allocated local indices are shifted by the number of parameters.
+  int IndexFor(Variable* variable) const {
+    Slot* slot = variable->AsSlot();
+    ASSERT(slot != NULL && slot->IsStackAllocated());
+    int shift = (slot->type() == Slot::PARAMETER) ? 1 : parameter_count_;
+    return slot->index() + shift;
+  }
 
   Handle<JSFunction> closure_;
   // Value array [parameters] [locals] [temporaries].
   ZoneList<HValue*> values_;
   ZoneList<int> assigned_variables_;
   int parameter_count_;
   int local_count_;
   HEnvironment* outer_;
   int pop_count_;
   int push_count_;
@@ skipping 22 matching lines @@
 
  protected:
   AstContext(HGraphBuilder* owner, Expression::Context kind);
   virtual ~AstContext();
 
   HGraphBuilder* owner() const { return owner_; }
 
   // We want to be able to assert, in a context-specific way, that the stack
   // height makes sense when the context is filled.
 #ifdef DEBUG
-  int original_count_;
+  int original_length_;
 #endif
 
  private:
   HGraphBuilder* owner_;
   Expression::Context kind_;
   AstContext* outer_;
 };
 
 
 class EffectContext: public AstContext {
@@ skipping 480 matching lines @@
   const char* filename_;
   HeapStringAllocator string_allocator_;
   StringStream trace_;
   int indent_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_HYDROGEN_H_