commit bcf06d3736eb07d39ab2ba8e065e5ee40ba9f4f3
author ggaren@apple.com <ggaren@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Jan 12 00:14:42 2012 +0000
committer ggaren@apple.com <ggaren@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Thu Jan 12 00:14:42 2012 +0000
tree e8d63e6ce5b2aabed188f2531f738d4d331619d7
parent 2f9cb148265b9b397f5be6fce5fb4cd24435ded5

REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
https://bugs.webkit.org/show_bug.cgi?id=75911

Source/JavaScriptCore: 

* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::emitNodeForLeftHandSide): Cleanup: No need to
explicitly cast to our return type in C++.

* bytecompiler/NodesCodegen.cpp:
(JSC::FunctionCallResolveNode::emitBytecode):
(JSC::ApplyFunctionCallDotNode::emitBytecode): Make sure to copy our function
into a temporary register before evaluating our arguments, since argument
evaluation might include function calls or assignments that overwrite our callee by name.

LayoutTests: 

Reviewed by Filip Pizlo.
        
* fast/js/function-argument-evaluation-expected.txt: Added.
* fast/js/function-argument-evaluation.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104762 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index a0127d8..132f666 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -365,9 +365,10 @@
 RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
+        RefPtr<RegisterID> function = generator.emitMove(generator.tempDestination(dst), local.get());
         CallArguments callArguments(generator, m_args);
         generator.emitLoad(callArguments.thisRegister(), jsUndefined());
-        return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), local.get(), callArguments, divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), function.get(), callArguments, divot(), startOffset(), endOffset());
     }
 
     int index = 0;
@@ -505,6 +506,7 @@
             RefPtr<RegisterID> profileHookRegister;
             if (generator.shouldEmitProfileHooks())
                 profileHookRegister = generator.newTemporary();
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
             RefPtr<RegisterID> thisRegister = generator.emitNode(m_args->m_listNode->m_expr);
             RefPtr<RegisterID> argsRegister;
             ArgumentListNode* args = m_args->m_listNode->m_next;
@@ -518,7 +520,7 @@
             while ((args = args->m_next))
                 generator.emitNode(args->m_expr);
 
-            generator.emitCallVarargs(finalDestinationOrIgnored.get(), base.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), profileHookRegister.get(), divot(), startOffset(), endOffset());
+            generator.emitCallVarargs(finalDestinationOrIgnored.get(), realFunction.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), profileHookRegister.get(), divot(), startOffset(), endOffset());
         }
         generator.emitJump(end.get());
     }