diff --git a/js/src/jsemit.h b/js/src/jsemit.h index 10333ca2142..fda43ebae16 100644 --- a/js/src/jsemit.h +++ b/js/src/jsemit.h @@ -261,7 +261,7 @@ struct JSTreeContext { /* tree context for semantic checks */ #define TCF_HAS_SHARPS 0x8000 /* source contains sharp defs or uses */ /* - * Flags to propagate from FunctionBody. + * Sticky deoptimization flags to propagate from FunctionBody. */ #define TCF_FUN_FLAGS (TCF_FUN_SETS_OUTER_NAME | \ TCF_FUN_USES_ARGUMENTS | \ diff --git a/js/src/jsparse.cpp b/js/src/jsparse.cpp index 39d0d275497..e46aca9f148 100644 --- a/js/src/jsparse.cpp +++ b/js/src/jsparse.cpp @@ -6405,9 +6405,15 @@ GeneratorExpr(JSParseNode *pn, JSParseNode *kid, JSTreeContext *tc) if (!funbox) return NULL; - gentc.flags |= TCF_FUN_IS_GENERATOR | TCF_GENEXP_LAMBDA; - if (tc->flags & TCF_HAS_SHARPS) - gentc.flags |= TCF_HAS_SHARPS; + /* + * We assume conservatively that any deoptimization flag in tc->flags + * besides TCF_FUN_PARAM_ARGUMENTS can come from the kid. So we + * propagate these flags into genfn. For code simplicity we also do + * not detect if the flags were only set in the kid and could be + * removed from tc->flags. + */ + gentc.flags |= TCF_FUN_IS_GENERATOR | TCF_GENEXP_LAMBDA | + (tc->flags & (TCF_FUN_FLAGS & ~TCF_FUN_PARAM_ARGUMENTS)); funbox->tcflags |= gentc.flags; genfn->pn_funbox = funbox; genfn->pn_blockid = gentc.bodyid;