Changeset 268593 in webkit for trunk/Source/JavaScriptCore/bytecompiler

Timestamp:

Oct 16, 2020, 8:52:27 AM (5 years ago)

Author:

[email protected]

Message:

Don't emit OpSpread with a constant as the destination
​https://bugs.webkit.org/show_bug.cgi?id=217800
<rdar://problem/69492311>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/spread-should-not-have-a-constant-as-dst.js: Added.

(foo):
(bar):

Source/JavaScriptCore:

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitConstruct):

File:

• trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -3306 +3306 @@
                 if (elements && !elements->next() && elements->value()->isSpreadExpression()) {
                     ExpressionNode* expression = static_cast<SpreadExpressionNode*>(elements->value())->expression();
-                    RefPtr<RegisterID> argumentRegister = emitNode(callArguments.argumentRegister(0), expression);
+                    RefPtr<RegisterID> argumentRegister = tempDestination(emitNode(callArguments.argumentRegister(0), expression));
                     OpSpread::emit(this, argumentRegister.get(), argumentRegister.get());
 
@@ -3510 +3510 @@
                 if (elements && !elements->next() && elements->value()->isSpreadExpression()) {
                     ExpressionNode* expression = static_cast<SpreadExpressionNode*>(elements->value())->expression();
-                    RefPtr<RegisterID> argumentRegister = emitNode(callArguments.argumentRegister(0), expression);
+                    RefPtr<RegisterID> argumentRegister = tempDestination(emitNode(callArguments.argumentRegister(0), expression));
                     OpSpread::emit(this, argumentRegister.get(), argumentRegister.get());