Bug 147063

Summary: lexical scoping is broken with respect to "break" and "continue"
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: basile_clement, benjamin, commit-queue, fpizlo, ggaren, joepeck, mark.lam, mmirman, msaboff, oliver, simon.fraser, ysuzuki
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 147070    
Bug Blocks: 31813    
Attachments:
Description Flags
patch none

Saam Barati
Reported 2015-07-17 19:26:26 PDT
There is some silliness in how byte code generator handles push/pop lexical scope and prepareScopeForNextForLoopIteration. This should be skipped. There is a silly mistake to always assume that scopeRegister() will be the scope in which we want to grab the parent scope of. This is fundamentally wrong. We want to grab the parent of the corresponding lexical scope. scopeRegister() just refers to scope stack top which is not always what we want to pop from.
Attachments
patch (22.95 KB, patch)
2015-07-18 02:02 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2015-07-18 02:02:11 PDT
Created attachment 257027 [details] patch
Saam Barati
Comment 2 2015-07-18 02:04:53 PDT
(In reply to comment #0) > There is some silliness in how byte code generator handles push/pop lexical > scope and prepareScopeForNextForLoopIteration. > This should be skipped. There is a silly mistake to always assume that > scopeRegister() will be the scope in which > we want to grab the parent scope of. This is fundamentally wrong. We want to > grab the parent of the corresponding > lexical scope. scopeRegister() just refers to scope stack top which is not > always what we want to pop from. This assessment is still correct. But it doesn't tell the whole story. This was a symptom, rather than the leading cause, of the problem this patch fixes.
WebKit Commit Bot
Comment 3 2015-07-18 13:13:31 PDT
Comment on attachment 257027 [details] patch Clearing flags on attachment: 257027 Committed r186996: <http://trac.webkit.org/changeset/186996>
WebKit Commit Bot
Comment 4 2015-07-18 13:13:37 PDT
All reviewed patches have been landed. Closing bug.
WebKit Commit Bot
Comment 6 2015-07-18 14:17:21 PDT
Re-opened since this is blocked by bug 147070
Saam Barati
Comment 7 2015-07-18 17:38:49 PDT
Fixed 32-bit tests. They were timing out. I made the test have fewer loop iterations. landed in: http://trac.webkit.org/changeset/187003
Note You need to log in before you can comment on or make changes to this bug.