Title: [232100] trunk
- Revision
- 232100
- Author
- mark....@apple.com
- Date
- 2018-05-22 20:11:32 -0700 (Tue, 22 May 2018)
Log Message
BytecodeGeneratorification shouldn't add a ValueProfile if the JIT is disabled.
https://bugs.webkit.org/show_bug.cgi?id=185896
<rdar://problem/40471403>
Reviewed by Saam Barati.
JSTests:
* stress/regress-185896.js: Added.
Source/_javascript_Core:
* bytecode/BytecodeGeneratorification.cpp:
(JSC::BytecodeGeneratorification::run):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (232099 => 232100)
--- trunk/JSTests/ChangeLog 2018-05-23 03:06:28 UTC (rev 232099)
+++ trunk/JSTests/ChangeLog 2018-05-23 03:11:32 UTC (rev 232100)
@@ -1,3 +1,13 @@
+2018-05-22 Mark Lam <mark....@apple.com>
+
+ BytecodeGeneratorification shouldn't add a ValueProfile if the JIT is disabled.
+ https://bugs.webkit.org/show_bug.cgi?id=185896
+ <rdar://problem/40471403>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-185896.js: Added.
+
2018-05-22 Yusuke Suzuki <utatane....@gmail.com>
[JSC] Fix CachedCall's argument count if RegExp has named captures
Added: trunk/JSTests/stress/regress-185896.js (0 => 232100)
--- trunk/JSTests/stress/regress-185896.js (rev 0)
+++ trunk/JSTests/stress/regress-185896.js 2018-05-23 03:11:32 UTC (rev 232100)
@@ -0,0 +1,14 @@
+var exception;
+function* items() {
+ yield { };
+ yield* 42;
+}
+
+try {
+ for (let i of items()) { }
+} catch (e) {
+ exception = e;
+}
+
+if (exception != "TypeError: undefined is not a function (near '...yield* 42...')")
+ throw FAILED;
Modified: trunk/Source/_javascript_Core/ChangeLog (232099 => 232100)
--- trunk/Source/_javascript_Core/ChangeLog 2018-05-23 03:06:28 UTC (rev 232099)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-05-23 03:11:32 UTC (rev 232100)
@@ -1,3 +1,14 @@
+2018-05-22 Mark Lam <mark....@apple.com>
+
+ BytecodeGeneratorification shouldn't add a ValueProfile if the JIT is disabled.
+ https://bugs.webkit.org/show_bug.cgi?id=185896
+ <rdar://problem/40471403>
+
+ Reviewed by Saam Barati.
+
+ * bytecode/BytecodeGeneratorification.cpp:
+ (JSC::BytecodeGeneratorification::run):
+
2018-05-22 Yusuke Suzuki <utatane....@gmail.com>
[JSC] Fix CachedCall's argument count if RegExp has named captures
Modified: trunk/Source/_javascript_Core/bytecode/BytecodeGeneratorification.cpp (232099 => 232100)
--- trunk/Source/_javascript_Core/bytecode/BytecodeGeneratorification.cpp 2018-05-23 03:06:28 UTC (rev 232099)
+++ trunk/Source/_javascript_Core/bytecode/BytecodeGeneratorification.cpp 2018-05-23 03:11:32 UTC (rev 232100)
@@ -229,7 +229,9 @@
VirtualRegister operand = virtualRegisterForLocal(index);
Storage storage = storageForGeneratorLocal(index);
- UnlinkedValueProfile profile = ""
+ UnlinkedValueProfile profile = ""
+ ? m_codeBlock->addValueProfile()
+ : static_cast<UnlinkedValueProfile>(-1);
fragment.appendInstruction(
op_get_from_scope,
operand.offset(), // dst
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
