Title: [188282] branches/jsc-tailcall/Source/_javascript_Core
- Revision
- 188282
- Author
- [email protected]
- Date
- 2015-08-11 13:08:56 -0700 (Tue, 11 Aug 2015)
Log Message
jsc-tailcall: REGRESSION: DFGByteCodeParser fails when a tail call is inside a ternary
https://bugs.webkit.org/show_bug.cgi?id=147849
Reviewed by Michael Saboff.
We were assuming that a tail call could only be followed by a return.
But it could also be followed by a jump to a return when the tail call
is inside a ternary _expression_.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
Modified Paths
Diff
Modified: branches/jsc-tailcall/Source/_javascript_Core/ChangeLog (188281 => 188282)
--- branches/jsc-tailcall/Source/_javascript_Core/ChangeLog 2015-08-11 20:06:34 UTC (rev 188281)
+++ branches/jsc-tailcall/Source/_javascript_Core/ChangeLog 2015-08-11 20:08:56 UTC (rev 188282)
@@ -1,5 +1,19 @@
2015-08-11 Basile Clement <[email protected]>
+ jsc-tailcall: REGRESSION: DFGByteCodeParser fails when a tail call is inside a ternary
+ https://bugs.webkit.org/show_bug.cgi?id=147849
+
+ Reviewed by Michael Saboff.
+
+ We were assuming that a tail call could only be followed by a return.
+ But it could also be followed by a jump to a return when the tail call
+ is inside a ternary _expression_.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+
+2015-08-11 Basile Clement <[email protected]>
+
jsc-tailcall: Add more strict mode tests
https://bugs.webkit.org/show_bug.cgi?id=147850
Modified: branches/jsc-tailcall/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (188281 => 188282)
--- branches/jsc-tailcall/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2015-08-11 20:06:34 UTC (rev 188281)
+++ branches/jsc-tailcall/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2015-08-11 20:08:56 UTC (rev 188282)
@@ -2694,7 +2694,11 @@
// logic relies on every bytecode resulting in one or more nodes, which would
// be true anyway except for op_loop_hint, which emits a Phantom to force this
// to be true.
- if (!m_currentBlock->isEmpty())
+ // We also don't insert a jump if the block already has a terminal,
+ // which could happen after a tail call.
+ ASSERT(m_currentBlock->isEmpty() || !m_currentBlock->terminal()
+ || m_currentBlock->terminal()->op() == TailCall || m_currentBlock->terminal()->op() == TailCallVarargs);
+ if (!m_currentBlock->isEmpty() && !m_currentBlock->terminal())
addToGraph(Jump, OpInfo(m_currentIndex));
return shouldContinueParsing;
}
@@ -3256,6 +3260,12 @@
// === Block terminators. ===
case op_jmp: {
+ if (m_currentBlock->terminal()) {
+ // We could be the dummy jump to a return after a non-inlined, non-emulated tail call in a ternary operator
+ Node* terminal = m_currentBlock->terminal();
+ ASSERT_UNUSED(terminal, terminal->op() == TailCall || terminal->op() == TailCallVarargs);
+ LAST_OPCODE(op_ret);
+ }
int relativeOffset = currentInstruction[1].u.operand;
addToGraph(Jump, OpInfo(m_currentIndex + relativeOffset));
if (relativeOffset <= 0)
@@ -3428,7 +3438,7 @@
if (m_currentBlock->terminal()) {
// We could be the dummy return after a non-inlined, non-emulated tail call
Node* terminal = m_currentBlock->terminal();
- ASSERT_UNUSED(terminal, terminal->op() == Return || terminal->op() == TailCall || terminal->op() == TailCallVarargs);
+ ASSERT_UNUSED(terminal, terminal->op() == TailCall || terminal->op() == TailCallVarargs);
LAST_OPCODE(op_ret);
}
if (inlineCallFrame()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
