Skip to content

Commit b27dd9f

Browse files
digitalinfinitydigitalinfinity
committed
Merge branch 'master' into linux
2 parents e7fc09c + ce943ff commit b27dd9f

181 files changed

Lines changed: 19021 additions & 16479 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Build/VCBuild/
1010
Build/VCBuild.NoJIT/
1111
Build/ipch/
1212
Build/.vs/
13+
Build/Chakra.Core.VC.db
1314
build_*.log
1415
build_*.wrn
1516
build_*.err

‎Build/Common.Build.props‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemDefinitionGroup>
44
<ClCompile>
5-
<PreprocessorDefinitions>%(PreprocessorDefinitions);NOMINMAX;USE_EDGEMODE_JSRT</PreprocessorDefinitions>
5+
<PreprocessorDefinitions>%(PreprocessorDefinitions);_CHAKRACOREBUILD;NOMINMAX;USE_EDGEMODE_JSRT</PreprocessorDefinitions>
66
<!-- Some of our STDMETHOD can throw
77
TODO: Code review STDMETHOD and separate out API that can throw and those that can't -->
88
<PreprocessorDefinitions>%(PreprocessorDefinitions);COM_STDMETHOD_CAN_THROW</PreprocessorDefinitions>

‎README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,9 @@ More details in [Building ChakraCore](https://github.com/Microsoft/ChakraCore/wi
6363

6464
Once built, you have a few options for how you can use ChakraCore:
6565

66-
* The most basic is to test the engine is running correctly with the *ch.exe* binary. This app is a lightweight hosting of JSRT that you can use to run small applications. After building, you can find this binary in: `Build\VcBuild\bin\[platform+output]` (eg. `Build\VcBuild\bin\x64_debug`)
66+
* The most basic is to test the engine is running correctly with the *ch.exe* binary. This app is a lightweight hosting of JSRT that you can use to run small applications. After building, you can find this binary in:
67+
* `Build\VcBuild\bin\${platform}_${configuration}`
68+
* (e.g. `Build\VcBuild\bin\x64_debug`)
6769
* You can [embed ChakraCore](https://github.com/Microsoft/ChakraCore/wiki/Embedding-ChakraCore) in your applications - see [documentation](https://github.com/Microsoft/ChakraCore/wiki/Embedding-ChakraCore) and [samples](http://aka.ms/chakracoresamples).
6870
* Finally, you can also use ChakraCore as the JavaScript engine in Node. You can learn more by reading how to use [Chakra as Node's JS engine](https://github.com/Microsoft/node)
6971

‎bin/ch/WScriptJsrt.cpp‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -606,7 +606,14 @@ void WScriptJsrt::AddMessageQueue(MessageQueue *_messageQueue)
606606

607607
WScriptJsrt::CallbackMessage::CallbackMessage(unsigned int time, JsValueRef function) : MessageBase(time), m_function(function)
608608
{
609-
ChakraRTInterface::JsAddRef(m_function, nullptr);
609+
JsErrorCode error = ChakraRTInterface::JsAddRef(m_function, nullptr);
610+
if (error != JsNoError)
611+
{
612+
// Simply report a fatal error and exit because continuing from this point would result in inconsistent state
613+
// and FailFast telemetry would not be useful.
614+
wprintf(_u("FATAL ERROR: ChakraRTInterface::JsAddRef failed in WScriptJsrt::CallbackMessage::`ctor`. error=0x%x\n"), error);
615+
exit(1);
616+
}
610617
}
611618

612619
WScriptJsrt::CallbackMessage::~CallbackMessage()

‎lib/Backend/BailOut.cpp‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1984,10 +1984,12 @@ void BailOutRecord::ScheduleFunctionCodeGen(Js::ScriptFunction * function, Js::S
19841984
break;
19851985

19861986
case IR::BailOutExpectingInteger:
1987+
profileInfo->DisableSwitchOpt();
19871988
rejitReason = RejitReason::DisableSwitchOptExpectingInteger;
19881989
break;
19891990

19901991
case IR::BailOutExpectingString:
1992+
profileInfo->DisableSwitchOpt();
19911993
rejitReason = RejitReason::DisableSwitchOptExpectingString;
19921994
break;
19931995

@@ -2135,6 +2137,18 @@ void BailOutRecord::ScheduleFunctionCodeGen(Js::ScriptFunction * function, Js::S
21352137
}
21362138
break;
21372139
}
2140+
case IR::BailOutOnPowIntIntOverflow:
2141+
{
2142+
if (profileInfo->IsPowIntIntTypeSpecDisabled())
2143+
{
2144+
reThunk = true;
2145+
}
2146+
else
2147+
{
2148+
profileInfo->DisablePowIntIntTypeSpec();
2149+
rejitReason = RejitReason::PowIntIntTypeSpecDisabled;
2150+
}
2151+
}
21382152
}
21392153

21402154
Assert(!(rejitReason != RejitReason::None && reThunk));
@@ -2444,6 +2458,12 @@ void BailOutRecord::ScheduleLoopBodyCodeGen(Js::ScriptFunction * function, Js::S
24442458
case IR::BailOutOnTaggedValue:
24452459
rejitReason = RejitReason::FailedTagCheck;
24462460
break;
2461+
2462+
case IR::BailOutOnPowIntIntOverflow:
2463+
profileInfo->DisablePowIntIntTypeSpec();
2464+
executeFunction->SetDontRethunkAfterBailout();
2465+
rejitReason = RejitReason::PowIntIntTypeSpecDisabled;
2466+
break;
24472467
}
24482468

24492469
if(PHASE_FORCE(Js::ReJITPhase, executeFunction) && rejitReason == RejitReason::None)

‎lib/Backend/BailOutKind.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,12 @@ BAIL_OUT_KIND(BailOutKindBitsStart, 0) // fake bail out kind to indicate start i
7575
BAIL_OUT_KIND_VALUE(BailOutOnOverflow, 1 << (BAIL_OUT_KIND_RESULT_CONDITIONS_BIT_START + 0))
7676
BAIL_OUT_KIND_VALUE(BailOutOnMulOverflow, 1 << (BAIL_OUT_KIND_RESULT_CONDITIONS_BIT_START + 1))
7777
BAIL_OUT_KIND_VALUE(BailOutOnNegativeZero, 1 << (BAIL_OUT_KIND_RESULT_CONDITIONS_BIT_START + 2))
78-
BAIL_OUT_KIND_VALUE(BailOutOnResultConditions, BailOutOnOverflow | BailOutOnMulOverflow | BailOutOnNegativeZero)
78+
BAIL_OUT_KIND_VALUE(BailOutOnPowIntIntOverflow, 1 << (BAIL_OUT_KIND_RESULT_CONDITIONS_BIT_START + 3))
79+
BAIL_OUT_KIND_VALUE(BailOutOnResultConditions, BailOutOnOverflow | BailOutOnMulOverflow | BailOutOnNegativeZero | BailOutOnPowIntIntOverflow)
7980
// ================
8081
// Array bits
8182
// ================
82-
#define BAIL_OUT_KIND_ARRAY_BIT_START BAIL_OUT_KIND_RESULT_CONDITIONS_BIT_START + 3
83+
#define BAIL_OUT_KIND_ARRAY_BIT_START BAIL_OUT_KIND_RESULT_CONDITIONS_BIT_START + 4
8384
BAIL_OUT_KIND_VALUE(BailOutOnMissingValue, 1 << (BAIL_OUT_KIND_ARRAY_BIT_START + 0))
8485
BAIL_OUT_KIND_VALUE(BailOutConventionalNativeArrayAccessOnly, 1 << (BAIL_OUT_KIND_ARRAY_BIT_START + 1))
8586
BAIL_OUT_KIND_VALUE(BailOutConvertedNativeArray, 1 << (BAIL_OUT_KIND_ARRAY_BIT_START + 2))

‎lib/Backend/GlobOpt.cpp‎

Lines changed: 107 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,9 @@ GlobOpt::GlobOpt(Func * func)
250250
doBoundCheckHoist &&
251251
!PHASE_OFF(Js::Phase::LoopCountBasedBoundCheckHoistPhase, func) &&
252252
!func->GetProfileInfo()->IsLoopCountBasedBoundCheckHoistDisabled(func->IsLoopBody())),
253+
doPowIntIntTypeSpec(
254+
doAggressiveIntTypeSpec &&
255+
!func->GetProfileInfo()->IsPowIntIntTypeSpecDisabled()),
253256
isAsmJSFunc(func->m_workItem->GetFunctionBody()->GetIsAsmjsMode())
254257
{
255258
}
@@ -971,6 +974,7 @@ GlobOpt::MergePredBlocksValueMaps(BasicBlock *block)
971974
BVSparse<JitArenaAllocator> symsRequiringCompensation(tempAlloc);
972975
{
973976
BVSparse<JitArenaAllocator> symsCreatedForMerge(tempAlloc);
977+
bool forceTypeSpecOnLoopHeader = true;
974978
FOREACH_PREDECESSOR_BLOCK(pred, block)
975979
{
976980
if (pred->globOptData.callSequence && pred->globOptData.callSequence->Empty())
@@ -1019,7 +1023,9 @@ GlobOpt::MergePredBlocksValueMaps(BasicBlock *block)
10191023
block,
10201024
pred,
10211025
isLoopPrePass ? nullptr : &symsRequiringCompensation,
1022-
isLoopPrePass ? nullptr : &symsCreatedForMerge);
1026+
isLoopPrePass ? nullptr : &symsCreatedForMerge,
1027+
forceTypeSpecOnLoopHeader);
1028+
forceTypeSpecOnLoopHeader = false; // can force type-spec on the loop header only for the first back edge.
10231029
}
10241030

10251031
// Restore the value for the next edge
@@ -1809,7 +1815,8 @@ GlobOpt::MergeBlockData(
18091815
BasicBlock *toBlock,
18101816
BasicBlock *fromBlock,
18111817
BVSparse<JitArenaAllocator> *const symsRequiringCompensation,
1812-
BVSparse<JitArenaAllocator> *const symsCreatedForMerge)
1818+
BVSparse<JitArenaAllocator> *const symsCreatedForMerge,
1819+
bool forceTypeSpecOnLoopHeader)
18131820
{
18141821
GlobOptBlockData *fromData = &(fromBlock->globOptData);
18151822

@@ -1881,7 +1888,7 @@ GlobOpt::MergeBlockData(
18811888
BVSparse<JitArenaAllocator> tempBv1(this->tempAlloc);
18821889
BVSparse<JitArenaAllocator> tempBv2(this->tempAlloc);
18831890

1884-
if (isLoopBackEdge)
1891+
if (isLoopBackEdge && forceTypeSpecOnLoopHeader)
18851892
{
18861893
Loop *const loop = toBlock->loop;
18871894

@@ -4134,6 +4141,24 @@ GlobOpt::IsAllowedForMemOpt(IR::Instr* instr, bool isMemset, IR::RegOpnd *baseOp
41344141
return false;
41354142
}
41364143

4144+
// The following is conservative and works around a bug in induction variable analysis.
4145+
if (baseOpnd->IsArrayRegOpnd())
4146+
{
4147+
IR::ArrayRegOpnd *baseArrayOp = baseOpnd->AsArrayRegOpnd();
4148+
bool hasBoundChecksRemoved = (
4149+
baseArrayOp->EliminatedLowerBoundCheck() &&
4150+
baseArrayOp->EliminatedUpperBoundCheck() &&
4151+
!instr->extractedUpperBoundCheckWithoutHoisting &&
4152+
!instr->loadedArrayHeadSegment &&
4153+
!instr->loadedArrayHeadSegmentLength
4154+
);
4155+
if (!hasBoundChecksRemoved)
4156+
{
4157+
TRACE_MEMOP_VERBOSE(loop, instr, L"Missing bounds check optimization");
4158+
return false;
4159+
}
4160+
}
4161+
41374162
if (!baseValueType.IsTypedArray())
41384163
{
41394164
// Check if the instr can kill the value type of the array
@@ -8970,6 +8995,11 @@ GlobOpt::OptConstFoldUnary(
89708995
case Js::OpCode::Ld_A:
89718996
if (instr->HasBailOutInfo())
89728997
{
8998+
//The profile data for switch expr can be string and in GlobOpt we realize it is an int.
8999+
if(instr->GetBailOutKind() == IR::BailOutExpectingString)
9000+
{
9001+
throw Js::RejitException(RejitReason::DisableSwitchOptExpectingString);
9002+
}
89739003
Assert(instr->GetBailOutKind() == IR::BailOutExpectingInteger);
89749004
instr->ClearBailOutInfo();
89759005
}
@@ -9549,7 +9579,6 @@ GlobOpt::TypeSpecializeInlineBuiltInBinary(IR::Instr **pInstr, Value *src1Val, V
95499579
switch(instr->m_opcode)
95509580
{
95519581
case Js::OpCode::InlineMathAtan2:
9552-
case Js::OpCode::InlineMathPow:
95539582
{
95549583
Js::BuiltinFunction builtInId = Js::JavascriptLibrary::GetBuiltInInlineCandidateId(instr->m_opcode); // From actual instr, not profile based.
95559584
Js::BuiltInFlags builtInFlags = Js::JavascriptLibrary::GetFlagsForBuiltIn(builtInId);
@@ -9567,6 +9596,47 @@ GlobOpt::TypeSpecializeInlineBuiltInBinary(IR::Instr **pInstr, Value *src1Val, V
95679596
break;
95689597
}
95699598

9599+
case Js::OpCode::InlineMathPow:
9600+
{
9601+
#ifndef _M_ARM
9602+
if (src2Val->GetValueInfo()->IsLikelyInt())
9603+
{
9604+
bool lossy = false;
9605+
9606+
this->ToInt32(instr, instr->GetSrc2(), this->currentBlock, src2Val, nullptr, lossy);
9607+
9608+
IR::Opnd* src1 = instr->GetSrc1();
9609+
int32 valueMin, valueMax;
9610+
if (src1Val->GetValueInfo()->IsLikelyInt() &&
9611+
this->DoPowIntIntTypeSpec() &&
9612+
src2Val->GetValueInfo()->GetIntValMinMax(&valueMin, &valueMax, this->DoAggressiveIntTypeSpec()) &&
9613+
valueMin >= 0)
9614+
9615+
{
9616+
this->ToInt32(instr, src1, this->currentBlock, src1Val, nullptr, lossy);
9617+
this->TypeSpecializeIntDst(instr, instr->m_opcode, nullptr, src1Val, src2Val, IR::BailOutInvalid, INT32_MIN, INT32_MAX, pDstVal);
9618+
9619+
if(!this->IsLoopPrePass())
9620+
{
9621+
GenerateBailAtOperation(&instr, IR::BailOutOnPowIntIntOverflow);
9622+
}
9623+
}
9624+
else
9625+
{
9626+
this->ToFloat64(instr, src1, this->currentBlock, src1Val, nullptr, IR::BailOutPrimitiveButString);
9627+
TypeSpecializeFloatDst(instr, nullptr, src1Val, src2Val, pDstVal);
9628+
}
9629+
}
9630+
else
9631+
{
9632+
#endif
9633+
this->TypeSpecializeFloatBinary(instr, src1Val, src2Val, pDstVal);
9634+
#ifndef _M_ARM
9635+
}
9636+
#endif
9637+
break;
9638+
}
9639+
95709640
case Js::OpCode::InlineMathImul:
95719641
{
95729642
Assert(this->DoAggressiveIntTypeSpec());
@@ -10435,7 +10505,8 @@ GlobOpt::TypeSpecializeBinary(IR::Instr **pInstr, Value **pSrc1Val, Value **pSrc
1043510505

1043610506
// Type specialize binary operators to int32
1043710507

10438-
bool lossy = true;
10508+
bool src1Lossy = true;
10509+
bool src2Lossy = true;
1043910510
IR::BailOutKind bailOutKind = IR::BailOutInvalid;
1044010511
bool ignoredIntOverflow = this->ignoredIntOverflowForCurrentInstr;
1044110512
bool ignoredNegativeZero = false;
@@ -10719,7 +10790,8 @@ GlobOpt::TypeSpecializeBinary(IR::Instr **pInstr, Value **pSrc1Val, Value **pSrc
1071910790
bailOutKind = IR::BailOutOnDivOfMinInt;
1072010791
}
1072110792

10722-
lossy = false; // Detect -0 on the sources
10793+
src1Lossy = false; // Detect -0 on the sources
10794+
src2Lossy = false;
1072310795

1072410796
opcode = Js::OpCode::Div_I4;
1072510797
bailOutKind |= IR::BailOnDivResultNotInt;
@@ -10939,7 +11011,17 @@ GlobOpt::TypeSpecializeBinary(IR::Instr **pInstr, Value **pSrc1Val, Value **pSrc
1093911011

1094011012
// Try to type specialize to int32
1094111013

10942-
lossy = false;
11014+
// If one of the values is a float constant with a value that fits in a uint32 but not an int32,
11015+
// and the instruction can ignore int overflow, the source value for the purposes of int specialization
11016+
// would have been changed to an int constant value by ignoring overflow. But, the conversion is still lossy.
11017+
if (!(src1OriginalVal && src1OriginalVal->GetValueInfo()->IsFloatConstant() && src1Val && src1Val->GetValueInfo()->HasIntConstantValue()))
11018+
{
11019+
src1Lossy = false;
11020+
}
11021+
if (!(src2OriginalVal && src2OriginalVal->GetValueInfo()->IsFloatConstant() && src2Val && src2Val->GetValueInfo()->HasIntConstantValue()))
11022+
{
11023+
src2Lossy = false;
11024+
}
1094311025

1094411026
switch(instr->m_opcode)
1094511027
{
@@ -11706,26 +11788,29 @@ GlobOpt::TypeSpecializeBinary(IR::Instr **pInstr, Value **pSrc1Val, Value **pSrc
1170611788
}
1170711789

1170811790
Value *src1ValueToSpecialize = src1Val, *src2ValueToSpecialize = src2Val;
11709-
if(lossy)
11791+
// Lossy conversions to int32 must be done based on the original source values. For instance, if one of the values is a
11792+
// float constant with a value that fits in a uint32 but not an int32, and the instruction can ignore int overflow, the
11793+
// source value for the purposes of int specialization would have been changed to an int constant value by ignoring
11794+
// overflow. If we were to specialize the sym using the int constant value, it would be treated as a lossless
11795+
// conversion, but since there may be subsequent uses of the same float constant value that may not ignore overflow,
11796+
// this must be treated as a lossy conversion by specializing the sym using the original float constant value.
11797+
if(src1Lossy)
1171011798
{
11711-
// Lossy conversions to int32 must be done based on the original source values. For instance, if one of the values is a
11712-
// float constant with a value that fits in a uint32 but not an int32, and the instruction can ignore int overflow, the
11713-
// source value for the purposes of int specialization would have been changed to an int constant value by ignoring
11714-
// overflow. If we were to specialize the sym using the int constant value, it would be treated as a lossless
11715-
// conversion, but since there may be subsequent uses of the same float constant value that may not ignore overflow,
11716-
// this must be treated as a lossy conversion by specializing the sym using the original float constant value.
1171711799
src1ValueToSpecialize = src1OriginalVal;
11800+
}
11801+
if (src2Lossy)
11802+
{
1171811803
src2ValueToSpecialize = src2OriginalVal;
1171911804
}
1172011805

1172111806
// Make sure the srcs are specialized
1172211807
src1 = instr->GetSrc1();
11723-
this->ToInt32(instr, src1, this->currentBlock, src1ValueToSpecialize, nullptr, lossy);
11808+
this->ToInt32(instr, src1, this->currentBlock, src1ValueToSpecialize, nullptr, src1Lossy);
1172411809

1172511810
if (!skipSrc2)
1172611811
{
1172711812
src2 = instr->GetSrc2();
11728-
this->ToInt32(instr, src2, this->currentBlock, src2ValueToSpecialize, nullptr, lossy);
11813+
this->ToInt32(instr, src2, this->currentBlock, src2ValueToSpecialize, nullptr, src2Lossy);
1172911814
}
1173011815

1173111816
if(bailOutKind != IR::BailOutInvalid && !this->IsLoopPrePass())
@@ -19320,6 +19405,12 @@ GlobOpt::DoLoopCountBasedBoundCheckHoist() const
1932019405
return doLoopCountBasedBoundCheckHoist;
1932119406
}
1932219407

19408+
bool
19409+
GlobOpt::DoPowIntIntTypeSpec() const
19410+
{
19411+
return doPowIntIntTypeSpec;
19412+
}
19413+
1932319414
bool
1932419415
GlobOpt::TrackArgumentsObject()
1932519416
{

‎lib/Backend/GlobOpt.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1249,6 +1249,7 @@ class GlobOpt
12491249
bool doBoundCheckHoist : 1;
12501250
bool doLoopCountBasedBoundCheckHoist : 1;
12511251

1252+
bool doPowIntIntTypeSpec : 1;
12521253
bool isAsmJSFunc : 1;
12531254
OpndList * noImplicitCallUsesToInsert;
12541255

@@ -1300,7 +1301,7 @@ class GlobOpt
13001301
void CloneBlockData(BasicBlock *const toBlock, BasicBlock *const fromBlock);
13011302
void CloneBlockData(BasicBlock *const toBlock, GlobOptBlockData *const toData, BasicBlock *const fromBlock);
13021303
void CloneValues(BasicBlock *const toBlock, GlobOptBlockData *toData, GlobOptBlockData *fromData);
1303-
void MergeBlockData(GlobOptBlockData *toData, BasicBlock *toBlock, BasicBlock *fromBlock, BVSparse<JitArenaAllocator> *const symsRequiringCompensation, BVSparse<JitArenaAllocator> *const symsCreatedForMerge);
1304+
void MergeBlockData(GlobOptBlockData *toData, BasicBlock *toBlock, BasicBlock *fromBlock, BVSparse<JitArenaAllocator> *const symsRequiringCompensation, BVSparse<JitArenaAllocator> *const symsCreatedForMerge, bool forceTypeSpecOnLoopHeader);
13041305
void DeleteBlockData(GlobOptBlockData *data);
13051306
IR::Instr * OptInstr(IR::Instr *&instr, bool* isInstrCleared);
13061307
Value* OptDst(IR::Instr **pInstr, Value *dstVal, Value *src1Val, Value *src2Val, Value *dstIndirIndexVal, Value *src1IndirIndexVal);
@@ -1623,6 +1624,7 @@ class GlobOpt
16231624
bool DoBoundCheckElimination() const;
16241625
bool DoBoundCheckHoist() const;
16251626
bool DoLoopCountBasedBoundCheckHoist() const;
1627+
bool DoPowIntIntTypeSpec() const;
16261628

16271629
private:
16281630
// GlobOptBailout.cpp

‎lib/Backend/IR.h‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,6 @@ class BranchJumpTableWrapper
5353
branchTargets->jmpTable = jmpTable;
5454
return branchTargets;
5555
}
56-
57-
static void Delete(JitArenaAllocator * allocator, BranchJumpTableWrapper * branchTargets)
58-
{
59-
Assert(allocator != nullptr && branchTargets != nullptr);
60-
JitAdeleteArray(allocator, branchTargets->tableSize, branchTargets->jmpTable);
61-
JitAdelete(allocator, branchTargets);
62-
}
6356
};
6457

6558
namespace IR {

‎lib/Backend/IRBuilder.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3677,7 +3677,7 @@ IRBuilder::BuildElementSlotI2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot r
36773677
instr = IR::Instr::New(Js::OpCode::Ld_A, regOpnd, addrOpnd, m_func);
36783678
this->AddInstr(instr, offset);
36793679

3680-
fieldSym = PropertySym::FindOrCreate(regOpnd->m_sym->m_id, slotId2, (uint32)-1, (uint)-1, PropertyKindSlots, m_func);
3680+
fieldSym = PropertySym::New(regOpnd->m_sym, slotId2, (uint32)-1, (uint)-1, PropertyKindSlots, m_func);
36813681
fieldOpnd = IR::SymOpnd::New(fieldSym, TyVar, m_func);
36823682

36833683
if (newOpcode == Js::OpCode::LdModuleSlot)
@@ -6707,9 +6707,9 @@ IRBuilder::BuildEmpty(Js::OpCode newOpcode, uint32 offset)
67076707
this->AddInstr(
67086708
IR::Instr::New(
67096709
Js::OpCode::LdFrameDisplay,
6710-
this->BuildDstOpnd(this->m_func->GetJnFunction()->GetFrameDisplayRegister()),
6710+
this->BuildDstOpnd(this->m_func->GetJnFunction()->GetLocalFrameDisplayRegister()),
67116711
this->BuildSrcOpnd(this->m_func->GetJnFunction()->GetLocalClosureRegister()),
6712-
this->BuildSrcOpnd(this->m_func->GetJnFunction()->GetFrameDisplayRegister()),
6712+
this->BuildSrcOpnd(this->m_func->GetJnFunction()->GetLocalFrameDisplayRegister()),
67136713
m_func),
67146714
Js::Constants::NoByteCodeOffset);
67156715
}

0 commit comments

Comments
 (0)