Changeset 204093 in webkit

Timestamp:

Aug 3, 2016, 11:50:57 AM (10 years ago)

Author:

fpizlo@apple.com

Message:

REGRESSION(r203368): broke some test262 tests
​https://bugs.webkit.org/show_bug.cgi?id=160479

Reviewed by Mark Lam.

JSTests:

Added a stress test for this case, since we don't always run test262.

• stress/freeze-setter.js: Added.

(let.o.set foo):

Source/JavaScriptCore:

The optimization in r203368 overlooked a subtle detail: freezing should not set ReadOnly on
Accessor properties.

• runtime/Structure.cpp:

(JSC::Structure::nonPropertyTransition):

• runtime/StructureTransitionTable.h:

(JSC::setsDontDeleteOnAllProperties):
(JSC::setsReadOnlyOnNonAccessorProperties):
(JSC::setsReadOnlyOnAllProperties): Deleted.

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/freeze-setter.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/Structure.cpp (modified) (3 diffs)
• Source/JavaScriptCore/runtime/StructureTransitionTable.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r203368): broke some test262 tests
+        https://bugs.webkit.org/show_bug.cgi?id=160479
+
+        Reviewed by Mark Lam.
+        
+        Added a stress test for this case, since we don't always run test262.
+
+        * stress/freeze-setter.js: Added.
+        (let.o.set foo):
+
 2016-08-03  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r203368): broke some test262 tests
+        https://bugs.webkit.org/show_bug.cgi?id=160479
+
+        Reviewed by Mark Lam.
+        
+        The optimization in r203368 overlooked a subtle detail: freezing should not set ReadOnly on
+        Accessor properties.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::setsDontDeleteOnAllProperties):
+        (JSC::setsReadOnlyOnNonAccessorProperties):
+        (JSC::setsReadOnlyOnAllProperties): Deleted.
+
 2016-08-03  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/JavaScriptCore/runtime/Structure.cpp

@@ -653 +653 @@
         transition->setDidPreventExtensions(true);
     
-    unsigned additionalPropertyAttributes = 0;
-    if (setsDontDeleteOnAllProperties(transitionKind))
-        additionalPropertyAttributes |= DontDelete;
-    if (setsReadOnlyOnAllProperties(transitionKind))
-        additionalPropertyAttributes |= ReadOnly;
-    if (additionalPropertyAttributes) {
+    if (setsDontDeleteOnAllProperties(transitionKind)
+        || setsReadOnlyOnNonAccessorProperties(transitionKind)) {
         // We pin the property table on transitions that do wholesale editing of the property
         // table, since our logic for walking the property transition chain to rematerialize the
@@ -669 +665 @@
         
         if (transition->propertyTable()) {
-            for (auto& entry : *transition->propertyTable().get())
-                entry.attributes |= additionalPropertyAttributes;
+            for (auto& entry : *transition->propertyTable().get()) {
+                if (setsDontDeleteOnAllProperties(transitionKind))
+                    entry.attributes |= DontDelete;
+                if (setsReadOnlyOnNonAccessorProperties(transitionKind) && !(entry.attributes & Accessor))
+                    entry.attributes |= ReadOnly;
+            }
         }
     } else {
@@ -678 +678 @@
     }
     
-    if (setsReadOnlyOnAllProperties(transitionKind)
+    if (setsReadOnlyOnNonAccessorProperties(transitionKind)
         && transition->propertyTable()
         && !transition->propertyTable()->isEmpty())

trunk/Source/JavaScriptCore/runtime/StructureTransitionTable.h

@@ -131 +131 @@
 }
 
-inline bool setsReadOnlyOnAllProperties(NonPropertyTransition transition)
+inline bool setsReadOnlyOnNonAccessorProperties(NonPropertyTransition transition)
 {
     switch (transition) {