Changeset 104762 in webkit

Timestamp:

Jan 11, 2012 4:14:42 PM (12 years ago)

Author:

ggaren@apple.com

Message:

REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
​https://bugs.webkit.org/show_bug.cgi?id=75911

Source/JavaScriptCore:

• bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitNodeForLeftHandSide): Cleanup: No need to
explicitly cast to our return type in C++.

• bytecompiler/NodesCodegen.cpp:

(JSC::FunctionCallResolveNode::emitBytecode):
(JSC::ApplyFunctionCallDotNode::emitBytecode): Make sure to copy our function
into a temporary register before evaluating our arguments, since argument
evaluation might include function calls or assignments that overwrite our callee by name.

LayoutTests:

Reviewed by Filip Pizlo.

• fast/js/function-argument-evaluation-expected.txt: Added.
• fast/js/function-argument-evaluation.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/function-argument-evaluation-expected.txt (added)
• LayoutTests/fast/js/function-argument-evaluation.html (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (modified) (1 diff)
• Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-01-09  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
+        https://bugs.webkit.org/show_bug.cgi?id=75911
+
+        Reviewed by Filip Pizlo.
+        
+        * fast/js/function-argument-evaluation-expected.txt: Added.
+        * fast/js/function-argument-evaluation.html: Added.
+
 2012-01-11  Adam Barth  <abarth@webkit.org>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-01-09  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
+        https://bugs.webkit.org/show_bug.cgi?id=75911
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeForLeftHandSide): Cleanup: No need to
+        explicitly cast to our return type in C++.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Make sure to copy our function
+        into a temporary register before evaluating our arguments, since argument
+        evaluation might include function calls or assignments that overwrite our callee by name.
+
 2012-01-11  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

@@ -275 +275 @@
             }
 
-            return PassRefPtr<RegisterID>(emitNode(n));
+            return emitNode(n);
         }
 

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -366 +366 @@
 {
     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+        RefPtr<RegisterID> function = generator.emitMove(generator.tempDestination(dst), local.get());
         CallArguments callArguments(generator, m_args);
         generator.emitLoad(callArguments.thisRegister(), jsUndefined());
-        return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), local.get(), callArguments, divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), function.get(), callArguments, divot(), startOffset(), endOffset());
     }
 
@@ -506 +507 @@
             if (generator.shouldEmitProfileHooks())
                 profileHookRegister = generator.newTemporary();
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
             RefPtr<RegisterID> thisRegister = generator.emitNode(m_args->m_listNode->m_expr);
             RefPtr<RegisterID> argsRegister;
@@ -519 +521 @@
                 generator.emitNode(args->m_expr);
 
-            generator.emitCallVarargs(finalDestinationOrIgnored.get(), base.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), profileHookRegister.get(), divot(), startOffset(), endOffset());
+            generator.emitCallVarargs(finalDestinationOrIgnored.get(), realFunction.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), profileHookRegister.get(), divot(), startOffset(), endOffset());
         }
         generator.emitJump(end.get());