Bug 70403 – bytecompiler sometimes generates incorrect bytecode for put_by_id

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Zheng Liu]

Bytecompiler sometimes generates incorrect bytecode for put_by_id.

case:(a same case of dot)
function f(a,i,j) {
  a.__defineSetter__('x',
      function(v) {
          this['z']=v;
          i='CLOBBERED';
      });
  j['y']=(a['x']=i);
  print(j.y);
};

f({},'RVAL',{});

expected: 'RVAL',  got: 'CLOBBERED'


Reason:
[  34] mov		 r4, "y"(@k1)
[  37] put_by_val	 r-9, "x"(@k0), r-8
[  41] put_by_val	 r3, r4, r-8

r-8 is clobbered in this case.
Expression (a['x']=i) should not forward r-8.

[Zheng Liu]

Created attachment 111577 [details]
A simple patch to copy the rvalue before put.

[Zheng Liu]

Created attachment 111596 [details]
Fix

Don't copy when the result is to be ignored.

[Zheng Liu]

Created attachment 111888 [details]
Correct format.

[Zheng Liu]

Created attachment 111891 [details]
Fix ChangeLog

[Filip Pizlo]

Great catch!  Took me a while to see what was going on.

Can you add a LayoutTest and include it in this patch?

[Geoffrey Garen]

Comment on attachment 111891 [details]
Fix ChangeLog

r-, but this patch looks ready to go once it has a layout test. See http://www.webkit.org/quality/testwriting.html.

[Zheng Liu]

Created attachment 111919 [details]
Added test at LayoutTests/fast/js.

[Filip Pizlo]

Comment on attachment 111919 [details]
Added test at LayoutTests/fast/js.

Looks great, r=me.

[WebKit Review Bot]

Comment on attachment 111919 [details]
Added test at LayoutTests/fast/js.

Clearing flags on attachment: 111919

Committed r98091: <http://trac.webkit.org/changeset/98091>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.