wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-25 16:47:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1331444 - Keep iterators alive in Ion in for-of loops for IteratorClose due to exceptions

Browse source 
Issue #74
This commit is contained in:
janekptacijarabaci 2018-03-25 12:37:06 +02:00 • committed by Roy Tam
commit 082451c781
3 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
js/src/jit-test/tests/for-of/bug-1331444.js Normal file
View file

@ -0,0 +1,7 @@
// |jit-test| error: ReferenceError
symbols = [Symbol];
for (comparator of[, ])
for (a of symbols)
for (;;)
expect;

19
js/src/jit/IonBuilder.cpp
View file

@ -961,11 +961,16 @@ IonBuilder::processIterators()
// Find phis that must directly hold an iterator live. // Find phis that must directly hold an iterator live.
Vector<MPhi*, 0, SystemAllocPolicy> worklist; Vector<MPhi*, 0, SystemAllocPolicy> worklist;
for (size_t i = 0; i < iterators_.length(); i++) { for (size_t i = 0; i < iterators_.length(); i++) {
MInstruction* ins = iterators_[i]; MDefinition* def = iterators_[i];
for (MUseDefIterator iter(ins); iter; iter++) { if (def->isPhi()) {
if (iter.def()->isPhi()) { if (!worklist.append(def->toPhi()))
if (!worklist.append(iter.def()->toPhi())) return false;
return false; } else {
for (MUseDefIterator iter(def); iter; iter++) {
if (iter.def()->isPhi()) {
if (!worklist.append(iter.def()->toPhi()))
return false;
}
} }
} }
} }
@ -1936,6 +1941,10 @@ IonBuilder::inspectOpcode(JSOp op)
case JSOP_CALLITER: case JSOP_CALLITER:
case JSOP_NEW: case JSOP_NEW:
case JSOP_SUPERCALL: case JSOP_SUPERCALL:
if (op == JSOP_CALLITER) {
if (!outermostBuilder()->iterators_.append(current->peek(-1)))
return false;
}
return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW || (JSOp)*pc == JSOP_SUPERCALL); return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW || (JSOp)*pc == JSOP_SUPERCALL);
case JSOP_EVAL: case JSOP_EVAL:

2
js/src/jit/IonBuilder.h
View file

@ -1242,7 +1242,7 @@ class IonBuilder
Vector<ControlFlowInfo, 4, JitAllocPolicy> loops_; Vector<ControlFlowInfo, 4, JitAllocPolicy> loops_;
Vector<ControlFlowInfo, 0, JitAllocPolicy> switches_; Vector<ControlFlowInfo, 0, JitAllocPolicy> switches_;
Vector<ControlFlowInfo, 2, JitAllocPolicy> labels_; Vector<ControlFlowInfo, 2, JitAllocPolicy> labels_;
Vector<MInstruction*, 2, JitAllocPolicy> iterators_; Vector<MDefinition*, 2, JitAllocPolicy> iterators_;
Vector<LoopHeader, 0, JitAllocPolicy> loopHeaders_; Vector<LoopHeader, 0, JitAllocPolicy> loopHeaders_;
BaselineInspector* inspector; BaselineInspector* inspector;