From 8bb9649135c384a08b78295b9d07be32d50967d1 Mon Sep 17 00:00:00 2001
From: janekptacijarabaci <janekptacijarabaci@seznam.cz>
Date: Sun, 25 Mar 2018 12:37:06 +0200
Subject: Bug 1331444 - Keep iterators alive in Ion in for-of loops for
 IteratorClose due to exceptions

Issue #74
---
 js/src/jit/IonBuilder.cpp | 19 ++++++++++++++-----
 js/src/jit/IonBuilder.h   |  2 +-
 2 files changed, 15 insertions(+), 6 deletions(-)

(limited to 'js/src/jit')

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index c4df415a4..4318db2b6 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -961,11 +961,16 @@ IonBuilder::processIterators()
     // Find phis that must directly hold an iterator live.
     Vector<MPhi*, 0, SystemAllocPolicy> worklist;
     for (size_t i = 0; i < iterators_.length(); i++) {
-        MInstruction* ins = iterators_[i];
-        for (MUseDefIterator iter(ins); iter; iter++) {
-            if (iter.def()->isPhi()) {
-                if (!worklist.append(iter.def()->toPhi()))
-                    return false;
+        MDefinition* def = iterators_[i];
+        if (def->isPhi()) {
+            if (!worklist.append(def->toPhi()))
+                return false;
+        } else {
+            for (MUseDefIterator iter(def); iter; iter++) {
+                if (iter.def()->isPhi()) {
+                    if (!worklist.append(iter.def()->toPhi()))
+                        return false;
+                }
             }
         }
     }
@@ -1936,6 +1941,10 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_CALLITER:
       case JSOP_NEW:
       case JSOP_SUPERCALL:
+        if (op == JSOP_CALLITER) {
+            if (!outermostBuilder()->iterators_.append(current->peek(-1)))
+                return false;
+        }
         return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW || (JSOp)*pc == JSOP_SUPERCALL);
 
       case JSOP_EVAL:
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 0d1bdb1e3..c3cd9700a 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -1242,7 +1242,7 @@ class IonBuilder
     Vector<ControlFlowInfo, 4, JitAllocPolicy> loops_;
     Vector<ControlFlowInfo, 0, JitAllocPolicy> switches_;
     Vector<ControlFlowInfo, 2, JitAllocPolicy> labels_;
-    Vector<MInstruction*, 2, JitAllocPolicy> iterators_;
+    Vector<MDefinition*, 2, JitAllocPolicy> iterators_;
     Vector<LoopHeader, 0, JitAllocPolicy> loopHeaders_;
     BaselineInspector* inspector;
 
-- 
cgit v1.2.3