Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (105107 => 105108)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-17 00:53:40 UTC (rev 105107)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-17 01:04:23 UTC (rev 105108)
@@ -1,3 +1,17 @@
+2011-1-16 Lucas Forschler <[email protected]>
+
+ Merge 104762
+
+ 2012-01-09 Geoffrey Garen <[email protected]>
+
+ REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
+ https://bugs.webkit.org/show_bug.cgi?id=75911
+
+ Reviewed by Filip Pizlo.
+
+ * fast/js/function-argument-evaluation-expected.txt: Added.
+ * fast/js/function-argument-evaluation.html: Added.
+
2012-01-16 Mark Rowe <[email protected]>
Merge r102540.
Copied: branches/safari-534.54-branch/LayoutTests/fast/js/function-argument-evaluation-expected.txt (from rev 104762, trunk/LayoutTests/fast/js/function-argument-evaluation-expected.txt) (0 => 105108)
--- branches/safari-534.54-branch/LayoutTests/fast/js/function-argument-evaluation-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/js/function-argument-evaluation-expected.txt 2012-01-17 01:04:23 UTC (rev 105108)
@@ -0,0 +1,7 @@
+This page tests function calls whose argument expressions overwrite the callee.
+
+If the test passes, you'll see PASS messages below.
+
+PASS: test1(callback, 1) should be 1 and is.
+PASS: test2(callback, 1) should be 1 and is.
+
Copied: branches/safari-534.54-branch/LayoutTests/fast/js/function-argument-evaluation.html (from rev 104762, trunk/LayoutTests/fast/js/function-argument-evaluation.html) (0 => 105108)
--- branches/safari-534.54-branch/LayoutTests/fast/js/function-argument-evaluation.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/js/function-argument-evaluation.html 2012-01-17 01:04:23 UTC (rev 105108)
@@ -0,0 +1,48 @@
+<p>This page tests function calls whose argument expressions overwrite the callee.</p>
+<p>If the test passes, you'll see PASS messages below.
+</p>
+<pre id="console"></pre>
+
+<script>
+function log(s)
+{
+ document.getElementById("console").appendChild(document.createTextNode(s + "\n"));
+}
+
+function shouldBe(aDescription, a, b)
+{
+ if (a === b) {
+ log("PASS: " + aDescription + " should be " + b + " and is.");
+ } else {
+ log("FAIL: " + aDescription + " should be " + b + " but instead is " + a + ".");
+ }
+}
+
+function test1(callback, x) {
+ try {
+ return callback.apply(this, [ callback = x ]);
+ } catch(e) {
+ return e;
+ }
+};
+
+function test2(callback, x) {
+ try {
+ return callback(callback = x);
+ } catch(e) {
+ return e;
+ }
+};
+
+(function () {
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ var callback = function callback(x) {
+ return x;
+ };
+
+ shouldBe("test1(callback, 1)", test1(callback, 1), 1);
+ shouldBe("test2(callback, 1)", test2(callback, 1), 1);
+})();
+</script>
Modified: branches/safari-534.54-branch/Source/_javascript_Core/ChangeLog (105107 => 105108)
--- branches/safari-534.54-branch/Source/_javascript_Core/ChangeLog 2012-01-17 00:53:40 UTC (rev 105107)
+++ branches/safari-534.54-branch/Source/_javascript_Core/ChangeLog 2012-01-17 01:04:23 UTC (rev 105108)
@@ -1,3 +1,22 @@
+2011-1-16 Lucas Forschler <[email protected]>
+
+ Merge 104762
+
+ 2012-01-09 Geoffrey Garen <[email protected]>
+
+ REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
+ https://bugs.webkit.org/show_bug.cgi?id=75911
+
+ * bytecompiler/BytecodeGenerator.h:
+ (JSC::BytecodeGenerator::emitNodeForLeftHandSide): Cleanup: No need to
+ explicitly cast to our return type in C++.
+
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::FunctionCallResolveNode::emitBytecode):
+ (JSC::ApplyFunctionCallDotNode::emitBytecode): Make sure to copy our function
+ into a temporary register before evaluating our arguments, since argument
+ evaluation might include function calls or assignments that overwrite our callee by name.
+
2011-1-13 Lucas Forschler <[email protected]>
Merge 104269
Modified: branches/safari-534.54-branch/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h (105107 => 105108)
--- branches/safari-534.54-branch/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h 2012-01-17 00:53:40 UTC (rev 105107)
+++ branches/safari-534.54-branch/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h 2012-01-17 01:04:23 UTC (rev 105108)
@@ -274,7 +274,7 @@
return dst;
}
- return PassRefPtr<RegisterID>(emitNode(n));
+ return emitNode(n);
}
RegisterID* emitLoad(RegisterID* dst, bool);
Modified: branches/safari-534.54-branch/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp (105107 => 105108)
--- branches/safari-534.54-branch/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2012-01-17 00:53:40 UTC (rev 105107)
+++ branches/safari-534.54-branch/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2012-01-17 01:04:23 UTC (rev 105108)
@@ -365,9 +365,10 @@
RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
{
if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+ RefPtr<RegisterID> function = generator.emitMove(generator.tempDestination(dst), local.get());
CallArguments callArguments(generator, m_args);
generator.emitLoad(callArguments.thisRegister(), jsUndefined());
- return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), local.get(), callArguments, divot(), startOffset(), endOffset());
+ return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), function.get(), callArguments, divot(), startOffset(), endOffset());
}
int index = 0;
@@ -505,6 +506,7 @@
RefPtr<RegisterID> profileHookRegister;
if (generator.shouldEmitProfileHooks())
profileHookRegister = generator.newTemporary();
+ RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
RefPtr<RegisterID> thisRegister = generator.emitNode(m_args->m_listNode->m_expr);
RefPtr<RegisterID> argsRegister;
ArgumentListNode* args = m_args->m_listNode->m_next;
@@ -518,7 +520,7 @@
while ((args = args->m_next))
generator.emitNode(args->m_expr);
- generator.emitCallVarargs(finalDestinationOrIgnored.get(), base.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), profileHookRegister.get(), divot(), startOffset(), endOffset());
+ generator.emitCallVarargs(finalDestinationOrIgnored.get(), realFunction.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), profileHookRegister.get(), divot(), startOffset(), endOffset());
}
generator.emitJump(end.get());
}
