DFG Validation fails when performing a concatenation with only a single entry
https://bugs.webkit.org/show_bug.cgi?id=158699
Reviewed by Saam Barati.
Fairly simple short circuiting of a single replacement template string
without any padding to be planted as a simple to string rather than
op_strcat.
* bytecompiler/NodesCodegen.cpp:
(JSC::TemplateLiteralNode::emitBytecode):
* tests/stress/template-literal.js:
(testSingleNode):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@202015 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 5831a87..68320c7 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,19 @@
+2016-06-13 Oliver Hunt <oliver@apple.com>
+
+ DFG Validation fails when performing a concatenation with only a single entry
+ https://bugs.webkit.org/show_bug.cgi?id=158699
+
+ Reviewed by Saam Barati.
+
+ Fairly simple short circuiting of a single replacement template string
+ without any padding to be planted as a simple to string rather than
+ op_strcat.
+
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::TemplateLiteralNode::emitBytecode):
+ * tests/stress/template-literal.js:
+ (testSingleNode):
+
2016-06-13 Filip Pizlo <fpizlo@apple.com>
FTL::Output methods should be out-of-line whenever possible
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 8abb458..bd28bd9 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -272,6 +272,9 @@
generator.emitNode(temporaryRegisters.last().get(), templateString->value());
}
+ if (temporaryRegisters.size() == 1)
+ return generator.emitToString(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get());
+
return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
}
diff --git a/Source/JavaScriptCore/tests/stress/template-literal.js b/Source/JavaScriptCore/tests/stress/template-literal.js
index 28b4472..5f66d6d 100644
--- a/Source/JavaScriptCore/tests/stress/template-literal.js
+++ b/Source/JavaScriptCore/tests/stress/template-literal.js
@@ -205,3 +205,35 @@
test(stat[1], undefined);
test(stat[2], undefined);
}());
+
+dfgTests =[
+ function testSingleNode() {
+ for (var i = 0; i < 1000; i++)
+ `${1}`
+ },
+ function testPreNode() {
+ for (var i = 0; i < 1000; i++)
+ `n${1}`
+ },
+ function testPostNode() {
+ for (var i = 0; i < 1000; i++)
+ `${1}n`
+ },
+ function testSingleObjectNode() {
+ for (var i = 0; i < 1000; i++)
+ `${{}}`
+ },
+ function testObjectPreNode() {
+ for (var i = 0; i < 1000; i++)
+ `n${{}}`
+ },
+ function testObjectPostNode() {
+ for (var i = 0; i < 1000; i++)
+ `${{}}n`
+ },
+];
+
+for(var f of dfgTests) {
+ noInline(f)
+ f();
+}
\ No newline at end of file
