Changeset 129948 in webkit for trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Timestamp:

Sep 28, 2012, 1:57:47 PM (13 years ago)

Author:

[email protected]

Message:

ASSERTION in m_graph[tailNodeIndex].op() == Flush

m_graph[tailNodeIndex].op() == SetLocal on plus.google.com

​https://bugs.webkit.org/show_bug.cgi?id=97656

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

There were two bugs here:

1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first,

rather than the last, of the GetLocals into the vars-at-tail table.

2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the

vars-at-tail table, when for captured variables only the last of those should be.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::getLocal):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests:

• fast/js/dfg-redundant-load-of-captured-variable-proven-constant-expected.txt: Added.
• fast/js/dfg-redundant-load-of-captured-variable-proven-constant.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-redundant-load-of-captured-variable-proven-constant.js: Added.

(o.f):

File:

• trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -228 +228 @@
                     nodeIndex = nodePtr->child1().index();
                 
-                return injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex));
+                NodeIndex newGetLocal = injectLazyOperandSpeculation(
+                    addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex));
+                m_currentBlock->variablesAtTail.local(operand) = newGetLocal;
+                return newGetLocal;
             }