Changeset 127544 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Sep 4, 2012, 7:36:45 PM (13 years ago)

Author:

[email protected]

Message:

inc/dec behave incorrectly operating on a resolved const
​https://bugs.webkit.org/show_bug.cgi?id=95815

Reviewed by Geoff Garen.

Source/JavaScriptCore:

There are two bugs here.

(1) When the value being incremented is const, and the result is ignored, we assume this cannot be observed, and emit no code.

However if the value being incremented is not a primitive & has a valueOf conversion, then this should be being called.

(2) In the case of a pre-increment of a const value where the result is not ignored, we'll move +/-1 to the destination, then

add the resolved const value being incremented to this. This is problematic if the destination is a local, and the const
value being incremented has a valueOf conversion that throws - the destination will be modified erroneously. Instead, we
need to use a temporary location.

• bytecompiler/NodesCodegen.cpp:

(JSC::PostfixResolveNode::emitBytecode):
(JSC::PrefixResolveNode::emitBytecode):

• always at least perform a toNumber conversion, use tempDestination when reducing inc/dec to an add +/-1.

LayoutTests:

Added test cases.

• fast/js/inc-const-valueOf-expected.txt: Added.
• fast/js/inc-const-valueOf.html: Added.
• fast/js/script-tests/inc-const-valueOf.js: Added.

(testPostIncConstVarWithIgnoredResult.const.a.valueOf):
(testPostIncConstVarWithIgnoredResult):

test that 'a++' results in a valueOf call, where 'a' is const.

(testPreIncConstVarWithIgnoredResult.const.a.valueOf):
(testPreIncConstVarWithIgnoredResult):

test that '++a' results in a valueOf call, where 'a' is const.

(testPreIncConstVarWithAssign.const.a.valueOf):
(testPreIncConstVarWithAssign):

test that 'b = ++a' does not erroneously update 'b', where 'a' is const.

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -610 +610 @@
 
     if (RegisterID* local = resolveResult.local()) {
-        if (resolveResult.isReadOnly()) {
-            if (dst == generator.ignoredResult())
-                return 0;
+        if (resolveResult.isReadOnly())
             return generator.emitToJSNumber(generator.finalDestination(dst), local);
-        }
         if (dst == generator.ignoredResult())
             return emitPreIncOrDec(generator, local, m_operator);
@@ -797 +794 @@
         if (resolveResult.isReadOnly()) {
             if (dst == generator.ignoredResult())
-                return 0;
-            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
-            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+                return generator.emitToJSNumber(generator.newTemporary(), local);
+            RefPtr<RegisterID> r0 = generator.emitLoad(generator.tempDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
+            generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+            return generator.moveToDestinationIfNeeded(dst, r0.get());
         }
         emitPreIncOrDec(generator, local, m_operator);