MakeRope fixup shouldn't lead to an Identity without kids
https://bugs.webkit.org/show_bug.cgi?id=118745
Source/JavaScriptCore:
Reviewed by Mark Hahnenberg.
Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
Make Node::convertToIdentity release-assert that it has exactly one kid.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupMakeRope):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToIdentity):
LayoutTests:
Reviewed by Mark Hahnenberg.
* fast/js/dfg-make-rope-all-empty-strings.html: Added.
* fast/js/dfg-make-rope-all-empty-strings-expected.txt: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-make-rope-all-empty-strings.js: Added.
(foo):
(bar):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@152742 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index c9a58d6..d5f6922 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -960,6 +960,11 @@
JSString* string = jsCast<JSString*>(m_graph.valueOfJSConstant(edge.node()).asCell());
if (string->length())
continue;
+
+ // Don't allow the MakeRope to have zero children.
+ if (!i && !node->child2())
+ break;
+
node->children.removeEdge(i--);
}
