Changeset 129948 in webkit for trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

Timestamp:

Sep 28, 2012, 1:57:47 PM (13 years ago)

Author:

[email protected]

Message:

ASSERTION in m_graph[tailNodeIndex].op() == Flush

m_graph[tailNodeIndex].op() == SetLocal on plus.google.com

​https://bugs.webkit.org/show_bug.cgi?id=97656

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

There were two bugs here:

1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first,

rather than the last, of the GetLocals into the vars-at-tail table.

2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the

vars-at-tail table, when for captured variables only the last of those should be.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::getLocal):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

LayoutTests:

• fast/js/dfg-redundant-load-of-captured-variable-proven-constant-expected.txt: Added.
• fast/js/dfg-redundant-load-of-captured-variable-proven-constant.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-redundant-load-of-captured-variable-proven-constant.js: Added.

(o.f):

File:

• trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@ -180 +180 @@
                 else {
                     ASSERT(m_graph[tailNodeIndex].op() == Flush
-                           || m_graph[tailNodeIndex].op() == SetLocal);
+                        || m_graph[tailNodeIndex].op() == SetLocal
+                        || node.variableAccessData()->isCaptured());
                 }
             }