Improved robustness of the optimizer when removing expressions

For example during dead code elimination we may invalidate statements,
but at the same time there may still be instances left in the work list
of optimizeSSA(). When we encounter then, we should not process them any
further.

Task-number: QTBUG-56255
Change-Id: I4c24b1a225ce1bde112172e9606f91c426c19f19
Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>

2 files changed, 14 insertions, 9 deletions

diff --git a/src/qml/compiler/qv4ssa.cpp b/src/qml/compiler/qv4ssa.cpp
index f20dbbf4fe..93692b3996 100644
--- a/src/qml/compiler/qv4ssa.cpp
+++ b/src/qml/compiler/qv4ssa.cpp
@@ -1968,14 +1968,9 @@ public:
         return *this;
     }
 
-    bool isEmpty() const
-    {
-        return worklistSize == 0;
-    }
-
     Stmt *takeNext(Stmt *last)
     {
-        if (isEmpty())
+        if (worklistSize == 0)
             return 0;
 
         const int startAt = last ? last->id() + 1 : 0;
@@ -1991,6 +1986,10 @@ public:
         --worklistSize;
         Stmt *s = stmts.at(pos);
         Q_ASSERT(s);
+
+        if (removed.at(s->id()))
+            return takeNext(s);
+
         return s;
     }
 
@@ -3960,9 +3959,7 @@ void optimizeSSA(StatementWorklist &W, DefUses &defUses, DominatorTree &df)
     ExprReplacer replaceUses(defUses, function);
 
     Stmt *s = 0;
-    while (!W.isEmpty()) {
-        s = W.takeNext(s);
-        Q_ASSERT(s);
+    while ((s = W.takeNext(s))) {
 
         if (Phi *phi = s->asPhi()) {
             // dead code elimination:
diff --git a/tests/auto/qml/qjsengine/tst_qjsengine.cpp b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
index 6cbafbf055..781f3f93e4 100644
--- a/tests/auto/qml/qjsengine/tst_qjsengine.cpp
+++ b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
@@ -197,6 +197,8 @@ private slots:
     void withNoContext();
     void holeInPropertyData();
 
+    void malformedExpression();
+
 signals:
     void testSignal();
 };
@@ -3872,6 +3874,12 @@ void tst_QJSEngine::holeInPropertyData()
     QVERIFY(ok.toBool());
 }
 
+void tst_QJSEngine::malformedExpression()
+{
+    QJSEngine engine;
+    engine.evaluate("5%55555&&5555555\n7-0");
+}
+
 QTEST_MAIN(tst_QJSEngine)
 
 #include "tst_qjsengine.moc"