Changeset 228454 in webkit


Ignore:
Timestamp:
Feb 13, 2018 9:07:07 PM (6 years ago)
Author:
sbarati@apple.com
Message:

putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
​https://bugs.webkit.org/show_bug.cgi?id=182755
<rdar://problem/37080864>

Reviewed by Keith Miller.

JSTests:

  • stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.

(test1.o.get 10005):
(test1):
(test2.o.get 1000):
(test2):

Source/JavaScriptCore:

putDirectIndexSlowOrBeyondVectorLength with non-zero attributes only converted
the object in question to a dictionary indexing mode when the index is less than
the vector length. This makes no sense. If we're defining a getter, setter, or read
only property, we must always enter the dictionary indexing mode irrespective
of the index in relation to the vector length.

  • runtime/JSObject.cpp:

(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):

Location:
trunk
Files:
1 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r228422 r228454  
     12018-02-13  Saam Barati  <sbarati@apple.com>
     2
     3        putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
     4        https://bugs.webkit.org/show_bug.cgi?id=182755
     5        <rdar://problem/37080864>
     6
     7        Reviewed by Keith Miller.
     8
     9        * stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
     10        (test1.o.get 10005):
     11        (test1):
     12        (test2.o.get 1000):
     13        (test2):
     14
    1152018-02-13  Caitlin Potter  <caitp@igalia.com>
    216

  • trunk/Source/JavaScriptCore/ChangeLog

    r228438 r228454  
     12018-02-13  Saam Barati  <sbarati@apple.com>
     2
     3        putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
     4        https://bugs.webkit.org/show_bug.cgi?id=182755
     5        <rdar://problem/37080864>
     6
     7        Reviewed by Keith Miller.
     8
     9        putDirectIndexSlowOrBeyondVectorLength with non-zero attributes only converted
     10        the object in question to a dictionary indexing mode when the index is less than
     11        the vector length. This makes no sense. If we're defining a getter, setter, or read
     12        only property, we must always enter the dictionary indexing mode irrespective
     13        of the index in relation to the vector length.
     14
     15        * runtime/JSObject.cpp:
     16        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
     17
    1182018-02-13  Saam Barati  <sbarati@apple.com>
    219

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r228306 r228454  
    29232923       
    29242924    case ALL_INT32_INDEXING_TYPES: {
    2925         if (attributes) {
    2926             if (i < m_butterfly->vectorLength())
    2927                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    2928             return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertInt32ToArrayStorage(vm));
    2929         }
     2925        ASSERT(!indexingShouldBeSparse());
     2926        if (attributes)
     2927            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    29302928        if (!value.isInt32()) {
    29312929            convertInt32ForValue(vm, value);
    … …  
    29372935       
    29382936    case ALL_DOUBLE_INDEXING_TYPES: {
    2939         if (attributes) {
    2940             if (i < m_butterfly->vectorLength())
    2941                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    2942             return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertDoubleToArrayStorage(vm));
    2943         }
     2937        ASSERT(!indexingShouldBeSparse());
     2938        if (attributes)
     2939            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    29442940        if (!value.isNumber()) {
    29452941            convertDoubleToContiguous(vm);
    … …  
    29562952       
    29572953    case ALL_CONTIGUOUS_INDEXING_TYPES: {
    2958         if (attributes) {
    2959             if (i < m_butterfly->vectorLength())
    2960                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    2961             return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertContiguousToArrayStorage(vm));
    2962         }
     2954        ASSERT(!indexingShouldBeSparse());
     2955        if (attributes)
     2956            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    29632957        putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(exec, i, value);
    29642958        return true;
    … …  
    29662960
    29672961    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
    2968         if (attributes) {
    2969             if (i < m_butterfly->vectorLength())
    2970                 return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    2971         }
     2962        if (attributes)
     2963            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
    29722964        return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, arrayStorage());
    29732965       
Note: See TracChangeset for help on using the changeset viewer.