Bug 1341339 - Check for duplicates in processIterators. r=jandem, a=lizzard
authorShu-yu Guo <shu@rfrn.org>
Wed, 22 Feb 2017 14:07:16 -0800
changeset 376408 48b049856be44ea59113efa763d8b30e9720cbf9
parent 376407 e5d37ee6a1d0954a6add1c740143b53aa48b00bc
child 376409 48e712105745330e121750acf1193d20cfe9f918
push id6996
push userjlorenzo@mozilla.com
push dateMon, 06 Mar 2017 20:48:21 +0000
treeherdermozilla-beta@d89512dab048 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, lizzard
bugs1341339
milestone53.0a2
Bug 1341339 - Check for duplicates in processIterators. r=jandem, a=lizzard
js/src/jit-test/tests/for-of/bug-1341339.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/for-of/bug-1341339.js
@@ -0,0 +1,9 @@
+let m = parseModule(`
+function* values() {}
+var iterator = values();
+for (var i=0; i < 10000; ++i) {
+    for (var x of iterator) {}
+}
+`);
+m.declarationInstantiation();
+m.evaluation();
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -865,19 +865,22 @@ IonBuilder::build()
 AbortReasonOr<Ok>
 IonBuilder::processIterators()
 {
     // Find and mark phis that must transitively hold an iterator live.
 
     Vector<MDefinition*, 8, SystemAllocPolicy> worklist;
 
     for (size_t i = 0; i < iterators_.length(); i++) {
-        if (!worklist.append(iterators_[i]))
-            return abort(AbortReason::Alloc);
-        iterators_[i]->setInWorklist();
+        MDefinition* iter = iterators_[i];
+        if (!iter->isInWorklist()) {
+            if (!worklist.append(iter))
+                return abort(AbortReason::Alloc);
+            iter->setInWorklist();
+        }
     }
 
     while (!worklist.empty()) {
         MDefinition* def = worklist.popCopy();
         def->setNotInWorklist();
 
         if (def->isPhi()) {
             MPhi* phi = def->toPhi();