Modified: trunk/JSTests/ChangeLog (238498 => 238499)
--- trunk/JSTests/ChangeLog 2018-11-26 17:42:12 UTC (rev 238498)
+++ trunk/JSTests/ChangeLog 2018-11-26 18:15:18 UTC (rev 238499)
@@ -1,3 +1,14 @@
+2018-11-26 Tadeu Zagallo <[email protected]>
+
+ ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
+ https://bugs.webkit.org/show_bug.cgi?id=191716
+ <rdar://problem/45723878>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-187373.js: Added.
+ (async.fn):
+
2018-11-21 Saam barati <[email protected]>
DFGSpeculativeJIT should not &= exitOK with mayExit(node)
Added: trunk/JSTests/stress/regress-187373.js (0 => 238499)
--- trunk/JSTests/stress/regress-187373.js (rev 0)
+++ trunk/JSTests/stress/regress-187373.js 2018-11-26 18:15:18 UTC (rev 238499)
@@ -0,0 +1,12 @@
+async function* fn() {
+ return p
+ return q
+ switch (0) {
+ case 1:
+ i++;
+ i++;
+ foo(x, arguments[z]);
+ break;
+ }
+}
+fn().next();
Modified: trunk/Source/_javascript_Core/ChangeLog (238498 => 238499)
--- trunk/Source/_javascript_Core/ChangeLog 2018-11-26 17:42:12 UTC (rev 238498)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-11-26 18:15:18 UTC (rev 238499)
@@ -1,3 +1,21 @@
+2018-11-26 Tadeu Zagallo <[email protected]>
+
+ ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
+ https://bugs.webkit.org/show_bug.cgi?id=191716
+ <rdar://problem/45723878>
+
+ Reviewed by Saam Barati.
+
+ After https://bugs.webkit.org/show_bug.cgi?id=187373, when updating
+ jump targets during generatorification, we only stored the new jump
+ target when it changed. However, the out-of-line jump targets are
+ cleared at the beginning of the pass, so we need to store it
+ unconditionally.
+
+ * bytecode/PreciseJumpTargetsInlines.h:
+ (JSC::extractStoredJumpTargetsForInstruction):
+ (JSC::updateStoredJumpTargetsForInstruction):
+
2018-11-23 Wenson Hsieh <[email protected]>
Enable drag and drop support for iOSMac
Modified: trunk/Source/_javascript_Core/bytecode/PreciseJumpTargetsInlines.h (238498 => 238499)
--- trunk/Source/_javascript_Core/bytecode/PreciseJumpTargetsInlines.h 2018-11-26 17:42:12 UTC (rev 238498)
+++ trunk/Source/_javascript_Core/bytecode/PreciseJumpTargetsInlines.h 2018-11-26 18:15:18 UTC (rev 238499)
@@ -112,7 +112,7 @@
}
template<typename Block, typename Function>
-inline void extractStoredJumpTargetsForInstruction(Block&& codeBlock, const InstructionStream::Ref& instruction, Function function)
+inline void extractStoredJumpTargetsForInstruction(Block&& codeBlock, const InstructionStream::Ref& instruction, const Function& function)
{
#define CASE_OP(__op) \
case __op::opcodeID: \
@@ -133,18 +133,16 @@
}
template<typename Block, typename Function, typename CodeBlockOrHashMap>
-inline void updateStoredJumpTargetsForInstruction(Block&& codeBlock, unsigned finalOffset, InstructionStream::MutableRef instruction, Function function, CodeBlockOrHashMap codeBlockOrHashMap)
+inline void updateStoredJumpTargetsForInstruction(Block&& codeBlock, unsigned finalOffset, InstructionStream::MutableRef instruction, const Function& function, CodeBlockOrHashMap& codeBlockOrHashMap)
{
#define CASE_OP(__op) \
case __op::opcodeID: { \
int32_t target = jumpTargetForInstruction<__op>(codeBlockOrHashMap, instruction); \
int32_t newTarget = function(target); \
- if (newTarget != target || finalOffset) { \
- instruction->cast<__op>()->setTarget(BoundLabel(newTarget), [&]() { \
- codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
- return BoundLabel(); \
- }); \
- } \
+ instruction->cast<__op>()->setTarget(BoundLabel(newTarget), [&]() { \
+ codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
+ return BoundLabel(); \
+ }); \
break; \
}
@@ -151,9 +149,7 @@
#define SWITCH_CASE(__target) \
do { \
int32_t target = __target; \
- int32_t newTarget = function(target); \
- if (newTarget != target) \
- __target = newTarget; \
+ __target = function(target); \
} while (false)
#define SWITCH_DEFAULT_OFFSET(__op) \
@@ -160,12 +156,10 @@
do { \
int32_t target = jumpTargetForInstruction(codeBlockOrHashMap, instruction, bytecode.defaultOffset); \
int32_t newTarget = function(target); \
- if (newTarget != target || finalOffset) { \
- instruction->cast<__op>()->setDefaultOffset(BoundLabel(newTarget), [&]() { \
- codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
- return BoundLabel(); \
- }); \
- } \
+ instruction->cast<__op>()->setDefaultOffset(BoundLabel(newTarget), [&]() { \
+ codeBlock->addOutOfLineJumpTarget(finalOffset + instruction.offset(), newTarget); \
+ return BoundLabel(); \
+ }); \
} while (false)
SWITCH_JMP(CASE_OP, SWITCH_CASE, SWITCH_DEFAULT_OFFSET)
