REGRESSION (r184337): ASSERT failed in debug builds for tagged templates

https://bugs.webkit.org/show_bug.cgi?id=145013

Reviewed by Filip Pizlo.

Fix the regression introduced by r184337.

1. JSTemporaryRegistryKey::s_info should inherit the Base::s_info,
   JSDestructibleObject::s_info.

2. The first register argument of BytecodeGenerator::emitNode
   should be a referenced register if it is a temporary register.

* bytecompiler/NodesCodegen.cpp:
(JSC::TaggedTemplateNode::emitBytecode):
* runtime/JSTemplateRegistryKey.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184347 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 3faf3b5..c5e3ce7 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,22 @@
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r184337): ASSERT failed in debug builds for tagged templates
+        https://bugs.webkit.org/show_bug.cgi?id=145013
+
+        Reviewed by Filip Pizlo.
+
+        Fix the regression introduced by r184337.
+
+        1. JSTemporaryRegistryKey::s_info should inherit the Base::s_info,
+           JSDestructibleObject::s_info.
+
+        2. The first register argument of BytecodeGenerator::emitNode
+           should be a referenced register if it is a temporary register.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TaggedTemplateNode::emitBytecode):
+        * runtime/JSTemplateRegistryKey.cpp:
+
 2015-05-14  Andreas Kling  <akling@apple.com>
 
         String.prototype.split() should create efficient substrings.

diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index e97d393..6430237 100644 (file)
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -271,7 +271,8 @@ RegisterID* TaggedTemplateNode::emitBytecode(BytecodeGenerator& generator, Regis
     RefPtr<RegisterID> tag = nullptr;
     RefPtr<RegisterID> base = nullptr;
     if (!m_tag->isLocation()) {
-        tag = generator.emitNode(generator.newTemporary(), m_tag);
+        tag = generator.newTemporary();
+        tag = generator.emitNode(tag.get(), m_tag);
     } else if (m_tag->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(m_tag);
         const Identifier& identifier = resolve->identifier();
@@ -291,13 +292,15 @@ RegisterID* TaggedTemplateNode::emitBytecode(BytecodeGenerator& generator, Regis
         }
     } else if (m_tag->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(m_tag);
-        base = generator.emitNode(generator.newTemporary(), bracket->base());
+        base = generator.newTemporary();
+        base = generator.emitNode(base.get(), bracket->base());
         RefPtr<RegisterID> property = generator.emitNode(bracket->subscript());
         tag = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
     } else {
         ASSERT(m_tag->isDotAccessorNode());
         DotAccessorNode* dot = static_cast<DotAccessorNode*>(m_tag);
-        base = generator.emitNode(generator.newTemporary(), dot->base());
+        base = generator.newTemporary();
+        base = generator.emitNode(base.get(), dot->base());
         tag = generator.emitGetById(generator.newTemporary(), base.get(), dot->identifier());
     }
 

diff --git a/Source/JavaScriptCore/runtime/JSTemplateRegistryKey.cpp b/Source/JavaScriptCore/runtime/JSTemplateRegistryKey.cpp
index 8014661..36de93a 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSTemplateRegistryKey.cpp
+++ b/Source/JavaScriptCore/runtime/JSTemplateRegistryKey.cpp
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-const ClassInfo JSTemplateRegistryKey::s_info = { "TemplateRegistryKey", nullptr, nullptr, CREATE_METHOD_TABLE(JSTemplateRegistryKey) };
+const ClassInfo JSTemplateRegistryKey::s_info = { "TemplateRegistryKey", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSTemplateRegistryKey) };
 
 
 JSTemplateRegistryKey::JSTemplateRegistryKey(VM& vm, const TemplateRegistryKey& templateRegistryKey)