Changeset 166240 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Mar 25, 2014, 11:00:30 AM (11 years ago)

Author:

[email protected]

Message:

ASSERTION FAILED in Parser: dst != localReg
​https://bugs.webkit.org/show_bug.cgi?id=130710

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Just make sure we don't try to write to a captured constant,
following the change to track captured variables separately.

• bytecompiler/NodesCodegen.cpp:

(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):

LayoutTests:

New testcases.

• js/parser-syntax-check-expected.txt:
• js/script-tests/parser-syntax-check.js:

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -741 +741 @@
             generator.emitReadOnlyExceptionIfNeeded();
             localReg = generator.emitMove(generator.tempDestination(dst), localReg);
-        }
-        if (local.isCaptured()) {
+        } else if (local.isCaptured()) {
             RefPtr<RegisterID> tempDst = generator.finalDestination(dst);
             ASSERT(dst != localReg);
@@ -917 +916 @@
             generator.emitReadOnlyExceptionIfNeeded();
             localReg = generator.emitMove(generator.tempDestination(dst), localReg);
-        }
-        if (local.isCaptured()) {
+        } else if (local.isCaptured()) {
             RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
             generator.emitMove(tempDst.get(), localReg);