From 6056525ced07af6c6c4f48ea605a2f4589821fdf Mon Sep 17 00:00:00 2001
From: janekptacijarabaci <janekptacijarabaci@seznam.cz>
Date: Sun, 25 Mar 2018 14:47:39 +0200
Subject: Bug 1341339 - Check for duplicates in processIterators

Issue #74
---
 js/src/jit-test/tests/for-of/bug-1341339.js | 9 +++++++++
 js/src/jit/IonBuilder.cpp                   | 9 ++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 js/src/jit-test/tests/for-of/bug-1341339.js

(limited to 'js/src')

diff --git a/js/src/jit-test/tests/for-of/bug-1341339.js b/js/src/jit-test/tests/for-of/bug-1341339.js
new file mode 100644
index 000000000..1f88acdaf
--- /dev/null
+++ b/js/src/jit-test/tests/for-of/bug-1341339.js
@@ -0,0 +1,9 @@
+let m = parseModule(`
+function* values() {}
+var iterator = values();
+for (var i=0; i < 10000; ++i) {
+    for (var x of iterator) {}
+}
+`);
+m.declarationInstantiation();
+m.evaluation();
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 534a48a90..26bba0656 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -963,9 +963,12 @@ IonBuilder::processIterators()
     Vector<MDefinition*, 8, SystemAllocPolicy> worklist;
 
     for (size_t i = 0; i < iterators_.length(); i++) {
-        if (!worklist.append(iterators_[i]))
-            return false;
-        iterators_[i]->setInWorklist();
+        MDefinition* iter = iterators_[i];
+        if (!iter->isInWorklist()) {
+            if (!worklist.append(iter))
+                return false;
+            iter->setInWorklist();
+        }
     }
 
     while (!worklist.empty()) {
-- 
cgit v1.2.3