commit fbf974e2af0f62b075e62701581099211f83adb6
author Jochen Eisinger <jochen@chromium.org> Sat Apr 29 19:10:42 2017
committer Commit Bot <commit-bot@chromium.org> Sat Apr 29 19:12:17 2017
tree 399a7a3f4eb472a9d07bf15d3e863f972c0089c0
parent 9ab3ade0e9ac230ec00cb4b903545d1450962c4c

Merged: Add missing early-bailouts in ast traversal visitors

Revision: 4e78b5a70c6443e3829b0bef10fd731062e27aa3

BUG=chromium:715582
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Change-Id: I0a148102c58dc2233966a90ba9f6d140879d55f0
Reviewed-on: https://chromium-review.googlesource.com/491026
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/branch-heads/5.9@{#33}
Cr-Branched-From: fe9bb7e6e251159852770160cfb21dad3cf03523-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad23791a21c0dd7ecef8d4d8dd30ff6fc291f6-refs/heads/master@{#44591}

src/asmjs/asm-wasm-builder.cc

diff --git a/src/asmjs/asm-wasm-builder.cc b/src/asmjs/asm-wasm-builder.cc
index f5eef49..a92e3ca 100644
--- a/src/asmjs/asm-wasm-builder.cc
+++ b/src/asmjs/asm-wasm-builder.cc
@@ -226,6 +226,7 @@
       }
       RECURSE(Visit(stmt));
       if (typer_failed_) break;
+      // Not stopping when a jump statement is found.
     }
   }
 

src/ast/ast-numbering.cc

diff --git a/src/ast/ast-numbering.cc b/src/ast/ast-numbering.cc
index 3e34f26..24ccf79 100644
--- a/src/ast/ast-numbering.cc
+++ b/src/ast/ast-numbering.cc
@@ -632,6 +632,7 @@
   if (statements == NULL) return;
   for (int i = 0; i < statements->length(); i++) {
     Visit(statements->at(i));
+    if (statements->at(i)->IsJump()) break;
   }
 }
 

test/mjsunit/regress/regress-715582.js

diff --git a/test/mjsunit/regress/regress-715582.js b/test/mjsunit/regress/regress-715582.js
new file mode 100644
index 0000000..0e81a92
--- /dev/null
+++ b/test/mjsunit/regress/regress-715582.js
@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Should not crash.
+//
+this.__defineGetter__(
+  "x", (a = (function f() { return; (function() {}); })()) => { });
+x;