Experimental: Merge 1395:1441 from bleeding_edge branch to the...

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 136 matching lines @@
       Result answer = frame_->CallStub(&stub, 3);
       frame_->Push(&answer);
     }
 
     if (scope_->num_heap_slots() > 0) {
       Comment cmnt(masm_, "[ allocate local context");
       // Allocate local context.
       // Get outer context and create a new context based on it.
       frame_->PushFunction();
       Result context = frame_->CallRuntime(Runtime::kNewContext, 1);
+
       // Update context local.
       frame_->SaveContextRegister();
 
-      if (kDebug) {
-        JumpTarget verified_true(this);
-        // Verify eax and esi are the same in debug mode
+      // Verify that the runtime call result and esi agree.
+      if (FLAG_debug_code) {
         __ cmp(context.reg(), Operand(esi));
-        context.Unuse();
-        verified_true.Branch(equal);
-        frame_->SpillAll();
-        __ int3();
-        verified_true.Bind();
+        __ Assert(equal, "Runtime::NewContext should end up in esi");
       }
     }
 
     // TODO(1241774): Improve this code:
     // 1) only needed if we have a context
     // 2) no need to recompute context ptr every single time
     // 3) don't copy parameter operand code from SlotOperand!
     {
       Comment cmnt2(masm_, "[ copy context parameters into .context");
 
@@ skipping 550 matching lines @@
     return OpBits::encode(op_) |
         ModeBits::encode(mode_) |
         FlagBits::encode(flags_);
   }
   void Generate(MacroAssembler* masm);
 };
 
 
 const char* GenericBinaryOpStub::GetName() {
   switch (op_) {
-  case Token::ADD: return "GenericBinaryOpStub_ADD";
-  case Token::SUB: return "GenericBinaryOpStub_SUB";
-  case Token::MUL: return "GenericBinaryOpStub_MUL";
-  case Token::DIV: return "GenericBinaryOpStub_DIV";
-  case Token::BIT_OR: return "GenericBinaryOpStub_BIT_OR";
-  case Token::BIT_AND: return "GenericBinaryOpStub_BIT_AND";
-  case Token::BIT_XOR: return "GenericBinaryOpStub_BIT_XOR";
-  case Token::SAR: return "GenericBinaryOpStub_SAR";
-  case Token::SHL: return "GenericBinaryOpStub_SHL";
-  case Token::SHR: return "GenericBinaryOpStub_SHR";
-  default:         return "GenericBinaryOpStub";
+    case Token::ADD: return "GenericBinaryOpStub_ADD";
+    case Token::SUB: return "GenericBinaryOpStub_SUB";
+    case Token::MUL: return "GenericBinaryOpStub_MUL";
+    case Token::DIV: return "GenericBinaryOpStub_DIV";
+    case Token::BIT_OR: return "GenericBinaryOpStub_BIT_OR";
+    case Token::BIT_AND: return "GenericBinaryOpStub_BIT_AND";
+    case Token::BIT_XOR: return "GenericBinaryOpStub_BIT_XOR";
+    case Token::SAR: return "GenericBinaryOpStub_SAR";
+    case Token::SHL: return "GenericBinaryOpStub_SHL";
+    case Token::SHR: return "GenericBinaryOpStub_SHR";
+    default:         return "GenericBinaryOpStub";
   }
 }
 
 
 class DeferredInlineBinaryOperation: public DeferredCode {
  public:
   DeferredInlineBinaryOperation(CodeGenerator* generator,
                                 Token::Value op,
                                 OverwriteMode mode,
                                 GenericBinaryFlags flags)
@@ skipping 73 matching lines @@
     GenericBinaryOpStub stub(op, overwrite_mode, flags);
     Result answer = frame_->CallStub(&stub, 2);
     frame_->Push(&answer);
   }
 }
 
 
 class DeferredInlineSmiOperation: public DeferredCode {
  public:
   DeferredInlineSmiOperation(CodeGenerator* generator,
-                              Token::Value op,
-                              Smi* value,
-                              OverwriteMode overwrite_mode)
+                             Token::Value op,
+                             Smi* value,
+                             OverwriteMode overwrite_mode)
       : DeferredCode(generator),
         op_(op),
         value_(value),
         overwrite_mode_(overwrite_mode) {
     set_comment("[ DeferredInlineSmiOperation");
   }
 
   virtual void Generate();
 
  private:
@@ skipping 260 matching lines @@
       if (reversed) {
         Result top = frame_->Pop();
         frame_->Push(value);
         frame_->Push(&top);
         GenericBinaryOperation(op, type, overwrite_mode);
       } else {
         // Only the least significant 5 bits of the shift value are used.
         // In the slow case, this masking is done inside the runtime call.
         int shift_value = int_value & 0x1f;
         DeferredCode* deferred =
-          new DeferredInlineSmiOperation(this, Token::SAR, smi_value,
-                                         overwrite_mode);
+            new DeferredInlineSmiOperation(this, Token::SAR, smi_value,
+                                           overwrite_mode);
         Result result = frame_->Pop();
         result.ToRegister();
         __ test(result.reg(), Immediate(kSmiTagMask));
         deferred->enter()->Branch(not_zero, &result, not_taken);
         frame_->Spill(result.reg());
         __ sar(result.reg(), shift_value);
         __ and_(result.reg(), ~kSmiTagMask);
         deferred->BindExit(&result);
         frame_->Push(&result);
       }
       break;
     }
 
     case Token::SHR: {
       if (reversed) {
         Result top = frame_->Pop();
         frame_->Push(value);
         frame_->Push(&top);
         GenericBinaryOperation(op, type, overwrite_mode);
       } else {
         // Only the least significant 5 bits of the shift value are used.
         // In the slow case, this masking is done inside the runtime call.
         int shift_value = int_value & 0x1f;
         DeferredCode* deferred =
-        new DeferredInlineSmiOperation(this, Token::SHR, smi_value,
-                                       overwrite_mode);
+            new DeferredInlineSmiOperation(this, Token::SHR, smi_value,
+                                           overwrite_mode);
         Result operand = frame_->Pop();
         operand.ToRegister();
         __ test(operand.reg(), Immediate(kSmiTagMask));
         deferred->enter()->Branch(not_zero, &operand, not_taken);
         Result answer = allocator()->Allocate();
         ASSERT(answer.is_valid());
         __ mov(answer.reg(), Operand(operand.reg()));
         __ sar(answer.reg(), kSmiTagSize);
         __ shr(answer.reg(), shift_value);
         // A negative Smi shifted right two is in the positive Smi range.
@@ skipping 15 matching lines @@
       if (reversed) {
         Result top = frame_->Pop();
         frame_->Push(value);
         frame_->Push(&top);
         GenericBinaryOperation(op, type, overwrite_mode);
       } else {
         // Only the least significant 5 bits of the shift value are used.
         // In the slow case, this masking is done inside the runtime call.
         int shift_value = int_value & 0x1f;
         DeferredCode* deferred =
-        new DeferredInlineSmiOperation(this, Token::SHL, smi_value,
-                                       overwrite_mode);
+            new DeferredInlineSmiOperation(this, Token::SHL, smi_value,
+                                           overwrite_mode);
         Result operand = frame_->Pop();
         operand.ToRegister();
         __ test(operand.reg(), Immediate(kSmiTagMask));
         deferred->enter()->Branch(not_zero, &operand, not_taken);
         Result answer = allocator()->Allocate();
         ASSERT(answer.is_valid());
         __ mov(answer.reg(), Operand(operand.reg()));
         ASSERT(kSmiTag == 0);  // adjust code if not the case
         // We do no shifts, only the Smi conversion, if shift_value is 1.
         if (shift_value == 0) {
@@ skipping 102 matching lines @@
   Result right_side(this);
   // Implement '>' and '<=' by reversal to obtain ECMA-262 conversion order.
   if (cc == greater || cc == less_equal) {
     cc = ReverseCondition(cc);
     left_side = frame_->Pop();
     right_side = frame_->Pop();
   } else {
     right_side = frame_->Pop();
     left_side = frame_->Pop();
   }
+  ASSERT(cc == less || cc == equal || cc == greater_equal);
+
   // If either side is a constant smi, optimize the comparison.
   bool left_side_constant_smi =
       left_side.is_constant() && left_side.handle()->IsSmi();
   bool right_side_constant_smi =
       right_side.is_constant() && right_side.handle()->IsSmi();
   bool left_side_constant_null =
       left_side.is_constant() && left_side.handle()->IsNull();
   bool right_side_constant_null =
       right_side.is_constant() && right_side.handle()->IsNull();
 
   if (left_side_constant_smi || right_side_constant_smi) {
     if (left_side_constant_smi && right_side_constant_smi) {
       // Trivial case, comparing two constants.
       int left_value = Smi::cast(*left_side.handle())->value();
       int right_value = Smi::cast(*right_side.handle())->value();
-      if (left_value < right_value &&
-          (cc == less || cc == less_equal || cc == not_equal) ||
-          left_value == right_value &&
-          (cc == less_equal || cc == equal || cc == greater_equal) ||
-          left_value > right_value &&
-          (cc == greater || cc == greater_equal || cc == not_equal)) {
-        // The comparison is unconditionally true.
-        dest->Goto(true);
-      } else {
-        // The comparison is unconditionally false.
-        dest->Goto(false);
+      switch (cc) {
+        case less:
+          dest->Goto(left_value < right_value);
+          break;
+        case equal:
+          dest->Goto(left_value == right_value);
+          break;
+        case greater_equal:
+          dest->Goto(left_value >= right_value);
+          break;
+        default:
+          UNREACHABLE();
       }
     } else {  // Only one side is a constant Smi.
       // If left side is a constant Smi, reverse the operands.
       // Since one side is a constant Smi, conversion order does not matter.
       if (left_side_constant_smi) {
         Result temp = left_side;
         left_side = right_side;
         right_side = temp;
         cc = ReverseCondition(cc);
         // This may reintroduce greater or less_equal as the value of cc.
@@ skipping 20 matching lines @@
       dest->false_target()->Jump();
 
       is_smi.Bind(&left_side, &right_side);
       left_side.ToRegister();
       // Test smi equality and comparison by signed int comparison.
       if (IsUnsafeSmi(right_side.handle())) {
         right_side.ToRegister();
         ASSERT(right_side.is_valid());
         __ cmp(left_side.reg(), Operand(right_side.reg()));
       } else {
-      __ cmp(Operand(left_side.reg()), Immediate(right_side.handle()));
+        __ cmp(Operand(left_side.reg()), Immediate(right_side.handle()));
       }
       left_side.Unuse();
       right_side.Unuse();
       dest->Split(cc);
     }
   } else if (cc == equal &&
              (left_side_constant_null || right_side_constant_null)) {
     // To make null checks efficient, we check if either the left side or
     // the right side is the constant 'null'.
     // If so, we optimize the code by inlining a null check instead of
@@ skipping 24 matching lines @@
       __ movzx_b(temp.reg(),
                  FieldOperand(temp.reg(), Map::kBitFieldOffset));
       __ test(temp.reg(), Immediate(1 << Map::kIsUndetectable));
       temp.Unuse();
       operand.Unuse();
       dest->Split(not_zero);
     }
   } else {  // Neither side is a constant Smi or null.
     // If either side is a non-smi constant, skip the smi check.
     bool known_non_smi =
-      left_side.is_constant() && !left_side.handle()->IsSmi() ||
-      right_side.is_constant() && !right_side.handle()->IsSmi();
+        (left_side.is_constant() && !left_side.handle()->IsSmi()) ||
+        (right_side.is_constant() && !right_side.handle()->IsSmi());
     left_side.ToRegister();
     right_side.ToRegister();
     JumpTarget is_smi(this);
     if (!known_non_smi) {
       // Check for the smi case.
       Result temp = allocator_->Allocate();
       ASSERT(temp.is_valid());
       __ mov(temp.reg(), left_side.reg());
       __ or_(temp.reg(), Operand(right_side.reg()));
       __ test(temp.reg(), Immediate(kSmiTagMask));
@@ skipping 427 matching lines @@
   Result context(this);
   if (node->is_catch_block()) {
     context = frame_->CallRuntime(Runtime::kPushCatchContext, 1);
   } else {
     context = frame_->CallRuntime(Runtime::kPushContext, 1);
   }
 
   // Update context local.
   frame_->SaveContextRegister();
 
-  if (kDebug) {
-    JumpTarget verified_true(this);
-    // Verify that the result of the runtime call and the esi register are
-    // the same in debug mode.
+  // Verify that the runtime call result and esi agree.
+  if (FLAG_debug_code) {
     __ cmp(context.reg(), Operand(esi));
-    context.Unuse();
-    verified_true.Branch(equal);
-    frame_->SpillAll();
-    __ int3();
-    verified_true.Bind();
+    __ Assert(equal, "Runtime::NewContext should end up in esi");
   }
 }
 
 
 void CodeGenerator::VisitWithExitStatement(WithExitStatement* node) {
   ASSERT(!in_spilled_code());
   Comment cmnt(masm_, "[ WithExitStatement");
   CodeForStatementPosition(node);
   // Pop context.
   __ mov(esi, ContextOperand(esi, Context::PREVIOUS_INDEX));
@@ skipping 131 matching lines @@
 }
 
 
 void CodeGenerator::VisitSwitchStatement(SwitchStatement* node) {
   ASSERT(!in_spilled_code());
   Comment cmnt(masm_, "[ SwitchStatement");
   CodeForStatementPosition(node);
   node->set_break_stack_height(break_stack_height_);
   node->break_target()->Initialize(this);
 
+  // Compile the switch value.
   Load(node->tag());
+
   if (TryGenerateFastCaseSwitchStatement(node)) {
     return;
   }
 
-  JumpTarget next_test(this);
-  JumpTarget fall_through(this);
-  JumpTarget default_entry(this);
-  JumpTarget default_exit(this, JumpTarget::BIDIRECTIONAL);
   ZoneList<CaseClause*>* cases = node->cases();
   int length = cases->length();
   CaseClause* default_clause = NULL;
 
-  // Loop over the cases, compiling tests and bodies.  Skip the
-  // default if found and compile it at the end.  Exit early if an
-  // unconditionally true match occurs (which can happen, eg, in the
-  // event the switch value is a compile-time constant).
-  //
-  // Bind the next_test target before entering the loop so we can use
-  // its state to detect whether the switch value needs to be dropped
-  // from the frame.
+  JumpTarget next_test(this);
+  // Compile the case label expressions and comparisons.  Exit early
+  // if a comparison is unconditionally true.  The target next_test is
+  // bound before the loop in order to indicate control flow to the
+  // first comparison.
   next_test.Bind();
-  int index = 0;
-  for (; index < length; index++) {
-    CaseClause* clause = cases->at(index);
+  for (int i = 0; i < length && !next_test.is_unused(); i++) {
+    CaseClause* clause = cases->at(i);
+    clause->body_target()->Initialize(this);
+    // The default is not a test, but remember it for later.
     if (clause->is_default()) {
-      // Remember the default clause and compile it at the end.
       default_clause = clause;
       continue;
     }
 
-    // Compile each non-default clause.
-    Comment cmnt(masm_, "[ Case clause");
-    // Recycle the same target for each test.
-    if (!next_test.is_unused()) {
-      // The next test target may be linked (as the target of a
-      // previous match failure) or bound (if the previous comparison
-      // was unconditionally false or this is the first non-default
-      // comparison).
-      if (next_test.is_linked()) {
-        next_test.Bind();
-      }
-      next_test.Unuse();
+    Comment cmnt(masm_, "[ Case comparison");
+    // We recycle the same target next_test for each test.  Bind it if
+    // the previous test has not done so and then unuse it for the
+    // loop.
+    if (next_test.is_linked()) {
+      next_test.Bind();
     }
+    next_test.Unuse();
 
     // Duplicate the switch value.
     frame_->Dup();
 
-    // Compile the clause's label expression.
+    // Compile the label expression.
     Load(clause->label());
 
-    // Compare and branch to the body if true and to the next test if
-    // false.
-    JumpTarget enter_body(this);
-    ControlDestination dest(&enter_body, &next_test, true);
+    // Compare and branch to the body if true or the next test if
+    // false.  Prefer the next test as a fall through.
+    ControlDestination dest(clause->body_target(), &next_test, false);
     Comparison(equal, true, &dest);
 
-    bool previous_was_default =
-        index > 0 && cases->at(index - 1)->is_default();
-    if (dest.false_was_fall_through()) {
-      // The false target next_test was bound as the fall-through.
-      // This may indicate that the comparison was unconditionally
-      // false if there are no dangling jumps to enter_body.  Even
-      // then we may still need to compile the body if it is reachable
-      // as a fall through.
-
-      // We do not need to compile the body if control cannot reach
-      // it.  Control could reach the body (1) from the comparison by
-      // a branch to enter_body, (2) as the fall through of some
-      // previous case, or (3) possibly via a backward jump from the
-      // default.
-      if (!enter_body.is_linked() &&
-          !fall_through.is_linked() &&
-          !previous_was_default) {
-        continue;
-      }
-
-      // We will compile the body and we have to jump around it on
-      // this path where the comparison failed.
-      next_test.Unuse();
-      next_test.Jump();
-      if (enter_body.is_linked()) {
-        enter_body.Bind();
-      }
-    }
-
-    // The body entry target may have been bound, indicating control
-    // flow can reach the body via the comparison.
-    if (enter_body.is_bound()) {
-      // The switch value is no longer needed.
-      frame_->Drop();
-    } else {
-      // The test was unconditionally false but we will compile the
-      // body as a fall through.
-      ASSERT(!has_valid_frame());
-    }
-
-    // Label the body if needed for fall through.
-    if (previous_was_default) {
-      // Because the default is compiled last, there is always a potential
-      // backwards edge to here, falling through from the default.
-      default_exit.Bind();
-    } else {
-      // Recycle the same target for each fall through.
-      fall_through.Bind();
-      fall_through.Unuse();
-    }
-
-    // Compile the body.
-    ASSERT(has_valid_frame());
-    { Comment body_cmnt(masm_, "[ Case body");
-      VisitStatements(clause->statements());
-    }
-
-    // The test may have been unconditionally true, which is indicated
-    // by the absence of any control flow to the next_test target.  In
-    // that case, exit this loop and stop compiling both tests and
-    // bodies (and begin compiling only bodies if necessary).
-
-    // Otherwise, if control flow can fall off the end of the body
-    // jump to the body of the next case as fall through unless this
-    // is the last non-default case.
-    if (!next_test.is_linked()) {
-      index++;
-      break;
-    } else if (has_valid_frame()) {
-      if (index < length - 2 &&  // There are at least two cases after this
-          cases->at(index + 1)->is_default()) {  // The next is the default.
-        default_entry.Jump();
-      } else if (index < length - 1) {  // This is not the last case.
-        fall_through.Jump();
-      }
+    // If the comparison fell through to the true target, jump to the
+    // actual body.
+    if (dest.true_was_fall_through()) {
+      clause->body_target()->Unuse();
+      clause->body_target()->Jump();
     }
   }
 
-  // If we did not compile all the cases then we must have hit one
-  // that was unconditionally true.  We do not need to compile any
-  // more tests but we may have (and continue to have) fall through.
-  for (; index < length && has_valid_frame(); index++) {
-    Comment cmnt(masm_, "[ Case fall-through");
-    VisitStatements(cases->at(index)->statements());
-  }
-
-  // Complete the switch statement based on the compilation state of
-  // the last case that was compiled.
-  if (next_test.is_unused()) {
-    // The last test compiled was unconditionally true.  We still need
-    // to compile the default if we found one and it can be targeted
-    // by fall through.
-    if (default_clause != NULL) {
-      bool was_only_clause = length == 1 && cases->at(0) == default_clause;
-      if (was_only_clause || default_entry.is_linked()) {
-        Comment cmnt(masm_, "[ Default clause");
-        default_entry.Bind();
-        VisitStatements(default_clause->statements());
-        // If control flow can fall off the end of the default and there
-        // was a case after it, jump to that case's body.
-        if (has_valid_frame() && default_exit.is_bound()) {
-          default_exit.Jump();
-        }
-      }
-    }
-  } else {
-    // The switch value is still on the frame.  We have to drop it and
-    // possibly compile a default case.
+  // If there was control flow to a next test from the last one
+  // compiled, compile a jump to the default or break target.
+  if (!next_test.is_unused()) {
     if (next_test.is_linked()) {
-      if (has_valid_frame()) {
-        // We have fall through and thus need to jump around the code
-        // to drop the switch value.
-        fall_through.Jump();
-      }
       next_test.Bind();
     }
+    // Drop the switch value.
     frame_->Drop();
-
-    // If there was a default clause, compile it now.
     if (default_clause != NULL) {
-      Comment cmnt(masm_, "[ Default clause");
-      if (default_entry.is_linked()) {
-        default_entry.Bind();
-      }
-      VisitStatements(default_clause->statements());
-      // If control flow can fall off the end of the default and there
-      // was a case after it, jump to that case's body.
-      if (has_valid_frame() && default_exit.is_bound()) {
-        default_exit.Jump();
-      }
+      default_clause->body_target()->Jump();
+    } else {
+      node->break_target()->Jump();
     }
   }
 
-  if (fall_through.is_linked()) {
-    fall_through.Bind();
+
+  // The last instruction emitted was a jump, either to the default
+  // clause or the break target, or else to a case body from the loop
+  // that compiles the tests.
+  ASSERT(!has_valid_frame());
+  // Compile case bodies as needed.
+  for (int i = 0; i < length; i++) {
+    CaseClause* clause = cases->at(i);
+
+    // There are two ways to reach the body: from the corresponding
+    // test or as the fall through of the previous body.
+    if (!clause->body_target()->is_linked() && !has_valid_frame()) {
+      // If we have neither, skip this body.
+      continue;
+    } else if (clause->body_target()->is_linked() && has_valid_frame()) {
+      // If we have both, put a jump on the fall through path to avoid
+      // the dropping of the switch value on the test path.  The
+      // exception is the default which has already had the switch
+      // value dropped.
+      if (clause->is_default()) {
+        clause->body_target()->Bind();
+      } else {
+        JumpTarget body(this);
+        body.Jump();
+        clause->body_target()->Bind();
+        frame_->Drop();
+        body.Bind();
+      }
+    } else if (clause->body_target()->is_linked()) {
+      // No fall through to worry about.
+      clause->body_target()->Bind();
+      if (!clause->is_default()) {
+        frame_->Drop();
+      }
+    } else {
+      // Otherwise, we have only fall through.
+      ASSERT(has_valid_frame());
+    }
+
+    // We are now prepared to compile the body.
+    Comment cmnt(masm_, "[ Case body");
+    VisitStatements(clause->statements());
   }
+
+  // We may not have a valid frame here so bind the break target only
+  // if needed.
   if (node->break_target()->is_linked()) {
     node->break_target()->Bind();
   }
 }
 
 
 void CodeGenerator::VisitLoopStatement(LoopStatement* node) {
   ASSERT(!in_spilled_code());
   Comment cmnt(masm_, "[ LoopStatement");
   CodeForStatementPosition(node);
@@ skipping 671 matching lines @@
       } else {
         // Fake TOS for targets that shadowed breaks and continues.
         frame_->EmitPush(Immediate(Factory::undefined_value()));
       }
       __ Set(ecx, Immediate(Smi::FromInt(JUMPING + i)));
       unlink.Jump();
     }
   }
 
   // Unlink from try chain; be careful not to destroy the TOS.
-  unlink.Bind();
-  // Reload sp from the top handler, because some statements that we
-  // break from (eg, for...in) may have left stuff on the stack.
-  // Preserve the TOS in a register across stack manipulation.
-  frame_->EmitPop(eax);
-  ExternalReference handler_address(Top::k_handler_address);
-  __ mov(edx, Operand::StaticVariable(handler_address));
-  const int kNextOffset = StackHandlerConstants::kNextOffset +
-      StackHandlerConstants::kAddressDisplacement;
-  __ lea(esp, Operand(edx, kNextOffset));
-  frame_->Forget(frame_->height() - handler_height);
+  if (unlink.is_linked()) {
+    unlink.Bind();
+  }
 
-  frame_->EmitPop(Operand::StaticVariable(handler_address));
-  frame_->Drop(StackHandlerConstants::kSize / kPointerSize - 1);
-  // Next_sp popped.
-  frame_->EmitPush(eax);
+  // Control can reach here via a jump to unlink or by falling off the
+  // end of the try block (with no unlinks).
+  if (has_valid_frame()) {
+    // Reload sp from the top handler, because some statements that we
+    // break from (eg, for...in) may have left stuff on the stack.
+    // Preserve the TOS in a register across stack manipulation.
+    frame_->EmitPop(eax);
+    ExternalReference handler_address(Top::k_handler_address);
+    __ mov(edx, Operand::StaticVariable(handler_address));
+    const int kNextOffset = StackHandlerConstants::kNextOffset +
+        StackHandlerConstants::kAddressDisplacement;
+    __ lea(esp, Operand(edx, kNextOffset));
+    frame_->Forget(frame_->height() - handler_height);
+
+    frame_->EmitPop(Operand::StaticVariable(handler_address));
+    frame_->Drop(StackHandlerConstants::kSize / kPointerSize - 1);
+    // Next_sp popped.
+    frame_->EmitPush(eax);
+  }
 
   // --- Finally block ---
   finally_block.Bind();
 
   // Push the state on the stack.
   frame_->EmitPush(ecx);
 
   // We keep two elements on the stack - the (possibly faked) result
   // and the state - while evaluating the finally block. Record it, so
   // that a break/continue crossing this statement can restore the
@@ skipping 566 matching lines @@
   frame_->Push(&boilerplate);
   // Clone the boilerplate object.
   Result clone =
       frame_->CallRuntime(Runtime::kCloneObjectLiteralBoilerplate, 1);
   // Push the newly cloned literal object as the result.
   frame_->Push(&clone);
 
   for (int i = 0; i < node->properties()->length(); i++) {
     ObjectLiteral::Property* property = node->properties()->at(i);
     switch (property->kind()) {
-      case ObjectLiteral::Property::CONSTANT: break;
+      case ObjectLiteral::Property::CONSTANT:
+        break;
+      case ObjectLiteral::Property::OBJECT_LITERAL:
+        if (property->value()->AsObjectLiteral()->is_simple()) break;
       case ObjectLiteral::Property::COMPUTED: {
         Handle<Object> key(property->key()->handle());
         Handle<Code> ic(Builtins::builtin(Builtins::StoreIC_Initialize));
         if (key->IsSymbol()) {
           // Duplicate the object as the IC receiver.
           frame_->Dup();
           Load(property->value());
           Result value = frame_->Pop();
           value.ToRegister(eax);
 
@@ skipping 3370 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal