[deoptimizer] Fix materialization of iterators.

jaro-sevcik · Commit Bot · commit 9a6f4422c6c1 · 2017-12-04T17:57:45.000Z
Bug: chromium:787301 Change-Id: If32310f9f2f3f04daa5bdaa9779302f4a012d397 Reviewed-on: https://chromium-review.googlesource.com/806223 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49843}
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
@@ -3317,6 +3317,7 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
     case JS_SET_VALUE_ITERATOR_TYPE: {
       Handle<JSSetIterator> object = Handle<JSSetIterator>::cast(
           isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> table = materializer.FieldAt(value_index);
@@ -3332,6 +3333,7 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
     case JS_MAP_VALUE_ITERATOR_TYPE: {
       Handle<JSMapIterator> object = Handle<JSMapIterator>::cast(
           isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> table = materializer.FieldAt(value_index);
diff --git a/test/mjsunit/compiler-regress-787301.js b/test/mjsunit/compiler-regress-787301.js
@@ -0,0 +1,26 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(b) {
+    let iterator = new Set().values();
+    iterator.x = 0;
+
+    let arr = [iterator, iterator];
+    if (b)
+        return arr.slice();
+}
+
+opt(false);
+opt(false);
+%OptimizeFunctionOnNextCall(opt);
+
+let res = opt(true);
+let a = res[0];
+let b = res[1];
+
+assertTrue(a === b);
+a.x = 7;
+assertEquals(7, b.x);
