Changeset 184347 in webkit

Timestamp:

May 14, 2015, 12:58:00 PM (10 years ago)

Author:

Yusuke Suzuki

Message:

REGRESSION (r184337): ASSERT failed in debug builds for tagged templates
​https://bugs.webkit.org/show_bug.cgi?id=145013

Reviewed by Filip Pizlo.

Fix the regression introduced by r184337.

1. JSTemporaryRegistryKey::s_info should inherit the Base::s_info, JSDestructibleObject::s_info.

2. The first register argument of BytecodeGenerator::emitNode should be a referenced register if it is a temporary register.

• bytecompiler/NodesCodegen.cpp:

(JSC::TaggedTemplateNode::emitBytecode):

• runtime/JSTemplateRegistryKey.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/NodesCodegen.cpp (modified) (3 diffs)
• runtime/JSTemplateRegistryKey.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r184337): ASSERT failed in debug builds for tagged templates
+        https://bugs.webkit.org/show_bug.cgi?id=145013
+
+        Reviewed by Filip Pizlo.
+
+        Fix the regression introduced by r184337.
+
+        1. JSTemporaryRegistryKey::s_info should inherit the Base::s_info,
+           JSDestructibleObject::s_info.
+
+        2. The first register argument of BytecodeGenerator::emitNode
+           should be a referenced register if it is a temporary register.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TaggedTemplateNode::emitBytecode):
+        * runtime/JSTemplateRegistryKey.cpp:
+
 2015-05-14  Andreas Kling  <akling@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -272 +272 @@
     RefPtr<RegisterID> base = nullptr;
     if (!m_tag->isLocation()) {
-        tag = generator.emitNode(generator.newTemporary(), m_tag);
+        tag = generator.newTemporary();
+        tag = generator.emitNode(tag.get(), m_tag);
     } else if (m_tag->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(m_tag);
@@ -292 +293 @@
     } else if (m_tag->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(m_tag);
-        base = generator.emitNode(generator.newTemporary(), bracket->base());
+        base = generator.newTemporary();
+        base = generator.emitNode(base.get(), bracket->base());
         RefPtr<RegisterID> property = generator.emitNode(bracket->subscript());
         tag = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
@@ -298 +300 @@
         ASSERT(m_tag->isDotAccessorNode());
         DotAccessorNode* dot = static_cast<DotAccessorNode*>(m_tag);
-        base = generator.emitNode(generator.newTemporary(), dot->base());
+        base = generator.newTemporary();
+        base = generator.emitNode(base.get(), dot->base());
         tag = generator.emitGetById(generator.newTemporary(), base.get(), dot->identifier());
     }

trunk/Source/JavaScriptCore/runtime/JSTemplateRegistryKey.cpp

@@ -33 +33 @@
 namespace JSC {
 
-const ClassInfo JSTemplateRegistryKey::s_info = { "TemplateRegistryKey", nullptr, nullptr, CREATE_METHOD_TABLE(JSTemplateRegistryKey) };
+const ClassInfo JSTemplateRegistryKey::s_info = { "TemplateRegistryKey", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSTemplateRegistryKey) };