summaryrefslogtreecommitdiffstats
path: root/js
diff options
context:
space:
mode:
authorjanekptacijarabaci <janekptacijarabaci@seznam.cz>2018-03-25 12:37:06 +0200
committerjanekptacijarabaci <janekptacijarabaci@seznam.cz>2018-03-25 12:37:06 +0200
commit8bb9649135c384a08b78295b9d07be32d50967d1 (patch)
tree1636d0b721a03e032e2b087ecae2359841196c32 /js
parent114eb8bf48ca0288f44705853239bdf198eeecdb (diff)
downloadUXP-8bb9649135c384a08b78295b9d07be32d50967d1.tar
UXP-8bb9649135c384a08b78295b9d07be32d50967d1.tar.gz
UXP-8bb9649135c384a08b78295b9d07be32d50967d1.tar.lz
UXP-8bb9649135c384a08b78295b9d07be32d50967d1.tar.xz
UXP-8bb9649135c384a08b78295b9d07be32d50967d1.zip
Bug 1331444 - Keep iterators alive in Ion in for-of loops for IteratorClose due to exceptions
Issue #74
Diffstat (limited to 'js')
-rw-r--r--js/src/jit-test/tests/for-of/bug-1331444.js7
-rw-r--r--js/src/jit/IonBuilder.cpp19
-rw-r--r--js/src/jit/IonBuilder.h2
3 files changed, 22 insertions, 6 deletions
diff --git a/js/src/jit-test/tests/for-of/bug-1331444.js b/js/src/jit-test/tests/for-of/bug-1331444.js
new file mode 100644
index 000000000..9770c584b
--- /dev/null
+++ b/js/src/jit-test/tests/for-of/bug-1331444.js
@@ -0,0 +1,7 @@
+// |jit-test| error: ReferenceError
+
+symbols = [Symbol];
+for (comparator of[, ])
+ for (a of symbols)
+ for (;;)
+ expect;
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index c4df415a4..4318db2b6 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -961,11 +961,16 @@ IonBuilder::processIterators()
// Find phis that must directly hold an iterator live.
Vector<MPhi*, 0, SystemAllocPolicy> worklist;
for (size_t i = 0; i < iterators_.length(); i++) {
- MInstruction* ins = iterators_[i];
- for (MUseDefIterator iter(ins); iter; iter++) {
- if (iter.def()->isPhi()) {
- if (!worklist.append(iter.def()->toPhi()))
- return false;
+ MDefinition* def = iterators_[i];
+ if (def->isPhi()) {
+ if (!worklist.append(def->toPhi()))
+ return false;
+ } else {
+ for (MUseDefIterator iter(def); iter; iter++) {
+ if (iter.def()->isPhi()) {
+ if (!worklist.append(iter.def()->toPhi()))
+ return false;
+ }
}
}
}
@@ -1936,6 +1941,10 @@ IonBuilder::inspectOpcode(JSOp op)
case JSOP_CALLITER:
case JSOP_NEW:
case JSOP_SUPERCALL:
+ if (op == JSOP_CALLITER) {
+ if (!outermostBuilder()->iterators_.append(current->peek(-1)))
+ return false;
+ }
return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW || (JSOp)*pc == JSOP_SUPERCALL);
case JSOP_EVAL:
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 0d1bdb1e3..c3cd9700a 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -1242,7 +1242,7 @@ class IonBuilder
Vector<ControlFlowInfo, 4, JitAllocPolicy> loops_;
Vector<ControlFlowInfo, 0, JitAllocPolicy> switches_;
Vector<ControlFlowInfo, 2, JitAllocPolicy> labels_;
- Vector<MInstruction*, 2, JitAllocPolicy> iterators_;
+ Vector<MDefinition*, 2, JitAllocPolicy> iterators_;
Vector<LoopHeader, 0, JitAllocPolicy> loopHeaders_;
BaselineInspector* inspector;