Changeset 166240 in webkit

Timestamp:

Mar 25, 2014 11:00:30 AM (10 years ago)

Author:

oliver@apple.com

Message:

ASSERTION FAILED in Parser: dst != localReg
​https://bugs.webkit.org/show_bug.cgi?id=130710

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Just make sure we don't try to write to a captured constant,
following the change to track captured variables separately.

• bytecompiler/NodesCodegen.cpp:

(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):

LayoutTests:

New testcases.

• js/parser-syntax-check-expected.txt:
• js/script-tests/parser-syntax-check.js:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/parser-syntax-check-expected.txt (modified) (1 diff)
• LayoutTests/js/script-tests/parser-syntax-check.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-03-24  Oliver Hunt  <oliver@apple.com>
+
+        ASSERTION FAILED in Parser: dst != localReg
+        https://bugs.webkit.org/show_bug.cgi?id=130710
+
+        Reviewed by Filip Pizlo.
+
+        New testcases.
+
+        * js/parser-syntax-check-expected.txt:
+        * js/script-tests/parser-syntax-check.js:
+
 2014-03-24  Brent Fulgham  <bfulgham@apple.com>
 

trunk/LayoutTests/js/parser-syntax-check-expected.txt

@@ -351 +351 @@
 PASS Invalid: "const a = b : c"
 PASS Invalid: "function f() { const a = b : c }"
+PASS Valid:   "const a = 7; eval(''); a++"
+PASS Valid:   "function f() { const a = 7; eval(''); a++ }"
+PASS Valid:   "const a = 7; eval(''); a--"
+PASS Valid:   "function f() { const a = 7; eval(''); a-- }"
+PASS Valid:   "const a = 7; with({}) a++"
+PASS Valid:   "function f() { const a = 7; with({}) a++ }"
+PASS Valid:   "const a = 7; with({}) a--"
+PASS Valid:   "function f() { const a = 7; with({}) a-- }"
+PASS Valid:   "const a = 7; eval(''); a+=1"
+PASS Valid:   "function f() { const a = 7; eval(''); a+=1 }"
+PASS Valid:   "const a = 7; eval(''); a-=1"
+PASS Valid:   "function f() { const a = 7; eval(''); a-=1 }"
+PASS Valid:   "const a = 7; with({}) a+=1"
+PASS Valid:   "function f() { const a = 7; with({}) a+=1 }"
+PASS Valid:   "const a = 7; with({}) a-=1"
+PASS Valid:   "function f() { const a = 7; with({}) a-=1 }"
+PASS Valid:   "const a = 7; eval(''); a=1"
+PASS Valid:   "function f() { const a = 7; eval(''); a=1 }"
+PASS Valid:   "const a = 7; eval(''); a=1"
+PASS Valid:   "function f() { const a = 7; eval(''); a=1 }"
+PASS Valid:   "const a = 7; with({}) a=1"
+PASS Valid:   "function f() { const a = 7; with({}) a=1 }"
+PASS Valid:   "const a = 7; with({}) a=1"
+PASS Valid:   "function f() { const a = 7; with({}) a=1 }"
 for statement
 PASS Valid:   "for ( ; ; ) { break }"

trunk/LayoutTests/js/script-tests/parser-syntax-check.js

@@ -242 +242 @@
 invalid("var a = b ? c, b");
 invalid("const a = b : c");
+valid("const a = 7; eval(''); a++");
+valid("const a = 7; eval(''); a--");
+valid("const a = 7; with({}) a++");
+valid("const a = 7; with({}) a--");
+valid("const a = 7; eval(''); a+=1");
+valid("const a = 7; eval(''); a-=1");
+valid("const a = 7; with({}) a+=1");
+valid("const a = 7; with({}) a-=1");
+valid("const a = 7; eval(''); a=1");
+valid("const a = 7; eval(''); a=1");
+valid("const a = 7; with({}) a=1");
+valid("const a = 7; with({}) a=1");
+
 
 debug  ("for statement");

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-03-24  Oliver Hunt  <oliver@apple.com>
+
+        ASSERTION FAILED in Parser: dst != localReg
+        https://bugs.webkit.org/show_bug.cgi?id=130710
+
+        Reviewed by Filip Pizlo.
+
+        Just make sure we don't try to write to a captured constant,
+        following the change to track captured variables separately.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+
 2014-03-25  Martin Robinson  <mrobinson@igalia.com>
 

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -741 +741 @@
             generator.emitReadOnlyExceptionIfNeeded();
             localReg = generator.emitMove(generator.tempDestination(dst), localReg);
-        }
-        if (local.isCaptured()) {
+        } else if (local.isCaptured()) {
             RefPtr<RegisterID> tempDst = generator.finalDestination(dst);
             ASSERT(dst != localReg);
@@ -917 +916 @@
             generator.emitReadOnlyExceptionIfNeeded();
             localReg = generator.emitMove(generator.tempDestination(dst), localReg);
-        }
-        if (local.isCaptured()) {
+        } else if (local.isCaptured()) {
             RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
             generator.emitMove(tempDst.get(), localReg);