Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-12 12:55:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix array comprehension code gen bug that broke constant folding (349653, r=mrbkap).

Browse Source
This commit is contained in:
brendan%mozilla.org 2006-09-01 06:16:14 +00:00
parent c8ea44c3ea
commit 02c0baa72f
4 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jsemit.c
View File

@ -5626,13 +5626,13 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
#if JS_HAS_GENERATORS
case TOK_ARRAYPUSH:
/*
* Pick up the array's stack index from pn->pn_array, which points up
* the tree to our TOK_ARRAYCOMP ancestor. See below under the array
* initialiser code generator for array comprehension special casing.
* The array object's stack index is in cg->arrayCompSlot. See below
* under the array initialiser code generator for array comprehension
* special casing.
*/
if (!js_EmitTree(cx, cg, pn->pn_kid))
return JS_FALSE;
EMIT_UINT16_IMM_OP(pn->pn_op, pn->pn_array->pn_extra);
EMIT_UINT16_IMM_OP(pn->pn_op, cg->arrayCompSlot);
break;
#endif
@ -5665,15 +5665,19 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
#if JS_HAS_GENERATORS
if (pn->pn_type == TOK_ARRAYCOMP) {
uintN saveSlot;
/*
* Pass the new array's stack index to the TOK_ARRAYPUSH case by
* storing it in pn->pn_extra, then simply traverse the TOK_FOR
* node and its kids under pn2 to generate this comprehension.
*/
JS_ASSERT(cg->stackDepth > 0);
pn->pn_extra = (uint32) (cg->stackDepth - 1);
saveSlot = cg->arrayCompSlot;
cg->arrayCompSlot = (uint32) (cg->stackDepth - 1);
if (!js_EmitTree(cx, cg, pn2))
return JS_FALSE;
cg->arrayCompSlot = saveSlot;
/* Emit the usual op needed for decompilation. */
if (js_Emit1(cx, cg, JSOP_ENDINIT) < 0)

2
js/src/jsemit.h
View File

@ -270,6 +270,8 @@ struct JSCodeGenerator {
ptrdiff_t spanDepTodo; /* offset from main.base of potentially
unoptimized spandeps */
uintN arrayCompSlot; /* stack slot of array in comprehension */
uintN emitLevel; /* js_EmitTree recursion level */
JSAtomList constList; /* compile time constants */
JSCodeGenerator *parent; /* Enclosing function or global context */

1
js/src/jsparse.c
View File

@ -5277,7 +5277,6 @@ PrimaryExpr(JSContext *cx, JSTokenStream *ts, JSTreeContext *tc,
pn2->pn_type = TOK_ARRAYPUSH;
pn2->pn_op = JSOP_ARRAYPUSH;
pn2->pn_kid = pnexp;
pn2->pn_array = pn;
*pnp = pn2;
PN_APPEND(pn, pntop);

3
js/src/jsparse.h
View File

@ -255,7 +255,6 @@ JS_BEGIN_EXTERN_C
* pn_extra: stack slot, used during code gen
* TOK_ARRAYPUSH unary pn_op: JSOP_ARRAYCOMP
* pn_kid: array comprehension expression
* pn_array: link to TOK_ARRAYCOMP
*/
typedef enum JSParseNodeArity {
PN_FUNC = -3,
@ -299,7 +298,6 @@ struct JSParseNode {
struct { /* one kid if unary */
JSParseNode *kid;
jsint num; /* -1 or sharp variable number */
JSParseNode *array; /* cyclic link to array comprehension */
} unary;
struct { /* name, labeled statement, etc. */
JSAtom *atom; /* name or label atom, null if slot */
@ -335,7 +333,6 @@ struct JSParseNode {
#define pn_val pn_u.binary.val
#define pn_kid pn_u.unary.kid
#define pn_num pn_u.unary.num
#define pn_array pn_u.unary.array
#define pn_atom pn_u.name.atom
#define pn_expr pn_u.name.expr
#define pn_slot pn_u.name.slot