haikuwebkit/LayoutTests/js/regress-146029.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-146029.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
Inlining in the DFG trashes ByteCodeParser::m_currentInstruction for the calling function https://bugs.webkit.org/show_bug.cgi?id=146029 Reviewed by Benjamin Poulain. Source/JavaScriptCore: Save and restore m_currentInstruction around call to ByteCodeParser::inlineCall() as it will use m_currentInstruction during its own parsing. This happens because inlineCall() parses the inlined callee's bytecodes by calling parseCodeBlock() which calls parseBlock() on each block. It is in parseBlock() that we set m_currentInstruction to an instruction before we parse it. * dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::attemptToInlineCall): (JSC::DFG::ByteCodeParser::parseBlock): Added an ASSERT to catch this issue. LayoutTests: New regression test. * js/regress-146029-expected.txt: Added. * js/regress-146029.html: Added. * js/script-tests/regress-146029.js: Added. (myPush): (myPop): (foo): (test): Canonical link: https://commits.webkit.org/164083@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@185627 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-06-17 00:06:14 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-146029.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`