зеркало из https://github.com/mozilla/gecko-dev.git
Fix array comprehension code gen bug that broke constant folding (349653, r=mrbkap).
This commit is contained in:
Родитель
c8ea44c3ea
Коммит
02c0baa72f
|
@ -5626,13 +5626,13 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
|
|||
#if JS_HAS_GENERATORS
|
||||
case TOK_ARRAYPUSH:
|
||||
/*
|
||||
* Pick up the array's stack index from pn->pn_array, which points up
|
||||
* the tree to our TOK_ARRAYCOMP ancestor. See below under the array
|
||||
* initialiser code generator for array comprehension special casing.
|
||||
* The array object's stack index is in cg->arrayCompSlot. See below
|
||||
* under the array initialiser code generator for array comprehension
|
||||
* special casing.
|
||||
*/
|
||||
if (!js_EmitTree(cx, cg, pn->pn_kid))
|
||||
return JS_FALSE;
|
||||
EMIT_UINT16_IMM_OP(pn->pn_op, pn->pn_array->pn_extra);
|
||||
EMIT_UINT16_IMM_OP(pn->pn_op, cg->arrayCompSlot);
|
||||
break;
|
||||
#endif
|
||||
|
||||
|
@ -5665,15 +5665,19 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
|
|||
|
||||
#if JS_HAS_GENERATORS
|
||||
if (pn->pn_type == TOK_ARRAYCOMP) {
|
||||
uintN saveSlot;
|
||||
|
||||
/*
|
||||
* Pass the new array's stack index to the TOK_ARRAYPUSH case by
|
||||
* storing it in pn->pn_extra, then simply traverse the TOK_FOR
|
||||
* node and its kids under pn2 to generate this comprehension.
|
||||
*/
|
||||
JS_ASSERT(cg->stackDepth > 0);
|
||||
pn->pn_extra = (uint32) (cg->stackDepth - 1);
|
||||
saveSlot = cg->arrayCompSlot;
|
||||
cg->arrayCompSlot = (uint32) (cg->stackDepth - 1);
|
||||
if (!js_EmitTree(cx, cg, pn2))
|
||||
return JS_FALSE;
|
||||
cg->arrayCompSlot = saveSlot;
|
||||
|
||||
/* Emit the usual op needed for decompilation. */
|
||||
if (js_Emit1(cx, cg, JSOP_ENDINIT) < 0)
|
||||
|
|
|
@ -270,6 +270,8 @@ struct JSCodeGenerator {
|
|||
ptrdiff_t spanDepTodo; /* offset from main.base of potentially
|
||||
unoptimized spandeps */
|
||||
|
||||
uintN arrayCompSlot; /* stack slot of array in comprehension */
|
||||
|
||||
uintN emitLevel; /* js_EmitTree recursion level */
|
||||
JSAtomList constList; /* compile time constants */
|
||||
JSCodeGenerator *parent; /* Enclosing function or global context */
|
||||
|
|
|
@ -5277,7 +5277,6 @@ PrimaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
|
|||
pn2->pn_type = TOK_ARRAYPUSH;
|
||||
pn2->pn_op = JSOP_ARRAYPUSH;
|
||||
pn2->pn_kid = pnexp;
|
||||
pn2->pn_array = pn;
|
||||
*pnp = pn2;
|
||||
PN_APPEND(pn, pntop);
|
||||
|
||||
|
|
|
@ -255,7 +255,6 @@ JS_BEGIN_EXTERN_C
|
|||
* pn_extra: stack slot, used during code gen
|
||||
* TOK_ARRAYPUSH unary pn_op: JSOP_ARRAYCOMP
|
||||
* pn_kid: array comprehension expression
|
||||
* pn_array: link to TOK_ARRAYCOMP
|
||||
*/
|
||||
typedef enum JSParseNodeArity {
|
||||
PN_FUNC = -3,
|
||||
|
@ -299,7 +298,6 @@ struct JSParseNode {
|
|||
struct { /* one kid if unary */
|
||||
JSParseNode *kid;
|
||||
jsint num; /* -1 or sharp variable number */
|
||||
JSParseNode *array; /* cyclic link to array comprehension */
|
||||
} unary;
|
||||
struct { /* name, labeled statement, etc. */
|
||||
JSAtom *atom; /* name or label atom, null if slot */
|
||||
|
@ -335,7 +333,6 @@ struct JSParseNode {
|
|||
#define pn_val pn_u.binary.val
|
||||
#define pn_kid pn_u.unary.kid
|
||||
#define pn_num pn_u.unary.num
|
||||
#define pn_array pn_u.unary.array
|
||||
#define pn_atom pn_u.name.atom
|
||||
#define pn_expr pn_u.name.expr
|
||||
#define pn_slot pn_u.name.slot
|
||||
|
|
Загрузка…
Ссылка в новой задаче