Changeset 270874 in webkit


Ignore:
Timestamp:
Dec 15, 2020 4:33:34 PM (19 months ago)
Author:
Alexey Shvayka
Message:

Non-enumerable property fails to shadow inherited enumerable property from for-in
​https://bugs.webkit.org/show_bug.cgi?id=38970

Reviewed by Keith Miller.

JSTests:

  • stress/arguments-bizarre-behaviour-disable-enumerability.js:
  • stress/for-in-redefine-enumerable.js: Added.
  • stress/for-in-shadow-non-enumerable.js: Added.
  • test262/expectations.yaml: Mark 4 test cases as passing.

Source/JavaScriptCore:

While for/in was initially specified with notion of "shadowing", it wasn't clarified
until ES5 that Enumerable? attributes are ignored when determining if a property
has already been processed. Recently, for/in spec was expanded [1] to pin down common
case enumeration as it's currently implemented by V8 and SpiderMonkey.

Since keeping track of DontEnum properties is a massive slowdown for uncached runs
(with any data structure used), this patch simply adds Enumerable? check to
has_{indexed,structure,generic}_property bytecode ops and does renaming chores.

Common code is now shared between HasIndexedProperty (emitted for 0 in arr) and
HasEnumerableIndexedProperty DFG nodes via passing different slow path ops rather
than having OpInfo with PropertySlot::InternalMethodType, which is a nice refactor.

While this change aligns common case for/in enumeration with the spec and other
engines, it also introduces a few observable discrepancies from V8 and SpiderMonkey,
which are permitted by the spec [2]:
a) properties that have been redefined as DontEnum within loop body are skipped,

which matches the spec [3] and seems like expected behavior;

b) "shadowing" is broken if a DontEnum property of already visited object is

added / deleted / redefined within loop body, which (pretty much) never happens.

This patch introduces a new invariant: all properties getOwn*PropertyNames() returns
in DontEnumPropertiesMode::Exclude should be reported as Enumerable? by
getOwnPropertySlot(). JSCallbackObject and RuntimeArray are fixed to follow it.

for/in and Object.keys microbenchmarks are neutral. This change does not affect
JSPropertyNameEnumerator caching, nor fast paths of its bytecodes.

[1]: ​https://github.com/tc39/ecma262/pull/1791
[2]: ​https://tc39.es/ecma262/#sec-enumerate-object-properties (last paragraph)
[3]: ​https://tc39.es/ecma262/#sec-%foriniteratorprototype%.next (step 7.b.iii)

  • API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::getOwnPropertySlot):

  • API/tests/testapi.c:
  • API/tests/testapiScripts/testapi.js:
  • bytecode/BytecodeList.rb:
  • bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):

  • bytecode/Opcode.h:
  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitHasEnumerableIndexedProperty):
(JSC::BytecodeGenerator::emitHasEnumerableStructureProperty):
(JSC::BytecodeGenerator::emitHasEnumerableProperty):
(JSC::BytecodeGenerator::emitHasGenericProperty): Deleted.
(JSC::BytecodeGenerator::emitHasIndexedProperty): Deleted.
(JSC::BytecodeGenerator::emitHasStructureProperty): Deleted.

  • bytecompiler/BytecodeGenerator.h:
  • bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitBytecode):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::convertToHasIndexedProperty):

  • dfg/DFGNode.h:

(JSC::DFG::Node::hasArrayMode):
(JSC::DFG::Node::hasInternalMethodType const): Deleted.
(JSC::DFG::Node::internalMethodType const): Deleted.
(JSC::DFG::Node::setInternalMethodType): Deleted.

  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

  • dfg/DFGOperations.h:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::handleNode):

  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileHasEnumerableProperty):
(JSC::DFG::SpeculativeJIT::compileHasEnumerableStructureProperty):
(JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
(JSC::DFG::SpeculativeJIT::compileHasGenericProperty): Deleted.
(JSC::DFG::SpeculativeJIT::compileHasStructureProperty): Deleted.

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileHasEnumerableProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileHasEnumerableStructureProperty):
(JSC::FTL::DFG::LowerDFGToB3::compileHasGenericProperty): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty): Deleted.

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

  • jit/JIT.h:
  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_has_enumerable_structure_property):
(JSC::JIT::emit_op_has_enumerable_indexed_property):
(JSC::JIT::emitSlow_op_has_enumerable_indexed_property):
(JSC::JIT::emit_op_has_structure_property): Deleted.
(JSC::JIT::emit_op_has_indexed_property): Deleted.
(JSC::JIT::emitSlow_op_has_indexed_property): Deleted.

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_has_enumerable_structure_property):
(JSC::JIT::emit_op_has_enumerable_indexed_property):
(JSC::JIT::emitSlow_op_has_enumerable_indexed_property):
(JSC::JIT::emit_op_has_structure_property): Deleted.
(JSC::JIT::emit_op_has_indexed_property): Deleted.
(JSC::JIT::emitSlow_op_has_indexed_property): Deleted.

  • jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

  • jit/JITOperations.h:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/CommonSlowPaths.cpp:

(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

  • runtime/CommonSlowPaths.h:
  • runtime/JSObject.cpp:

(JSC::JSObject::hasProperty const):
(JSC::JSObject::hasEnumerableProperty const):
(JSC::JSObject::hasPropertyGeneric const): Deleted.

  • runtime/JSObject.h:

Source/WebCore:

Report RuntimeArray indices as Enumerable?.

Test: platform/mac/fast/dom/wrapper-classes-objc.html

  • bridge/runtime_array.cpp:

(JSC::RuntimeArray::getOwnPropertySlot):
(JSC::RuntimeArray::getOwnPropertySlotByIndex):

LayoutTests:

  • platform/mac/fast/dom/wrapper-classes-objc-expected.txt:
  • platform/mac/fast/dom/wrapper-classes-objc.html:
Location:
trunk
Files:
2 added
50 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r270869 r270874  
     12020-12-15  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        Non-enumerable property fails to shadow inherited enumerable property from for-in
     4        https://bugs.webkit.org/show_bug.cgi?id=38970
     5
     6        Reviewed by Keith Miller.
     7
     8        * stress/arguments-bizarre-behaviour-disable-enumerability.js:
     9        * stress/for-in-redefine-enumerable.js: Added.
     10        * stress/for-in-shadow-non-enumerable.js: Added.
     11        * test262/expectations.yaml: Mark 4 test cases as passing.
     12
    1132020-12-15  Yusuke Suzuki  <ysuzuki@apple.com>
    214

  • trunk/JSTests/stress/arguments-bizarre-behaviour-disable-enumerability.js

    r210146 r270874  
    1919    array.push(s);
    2020
    21 if (array.join(",") != "0")
     21if (array.join(",") != "")
    2222    throw new Error();
    2323

  • trunk/JSTests/test262/expectations.yaml

    r270695 r270874  
    18591859  default: 'Test262:AsyncTestFailure:Test262Error: Test262Error: Expected [pre, tick 1, constructor, constructor, tick 2, tick 3, loop, tick 4, constructor] and [pre, constructor, constructor, tick 1, tick 2, loop, constructor, tick 3, tick 4, post] to have the same contents. Ticks and constructor lookups'
    18601860  strict mode: 'Test262:AsyncTestFailure:Test262Error: Test262Error: Expected [pre, tick 1, constructor, constructor, tick 2, tick 3, loop, tick 4, constructor] and [pre, constructor, constructor, tick 1, tick 2, loop, constructor, tick 3, tick 4, post] to have the same contents. Ticks and constructor lookups'
    1861 test/language/statements/for-in/12.6.4-2.js:
    1862   default: 'Test262Error: accessedProp Expected SameValue(«true», «false») to be true'
    1863   strict mode: 'Test262Error: accessedProp Expected SameValue(«true», «false») to be true'
    18641861test/language/statements/for-in/head-lhs-let.js:
    18651862  default: "SyntaxError: Cannot use the keyword 'in' as a lexical variable name."
    18661863test/language/statements/for-in/identifier-let-allowed-as-lefthandside-expression-not-strict.js:
    18671864  default: "SyntaxError: Cannot use the keyword 'in' as a lexical variable name."
    1868 test/language/statements/for-in/order-enumerable-shadowed.js:
    1869   default: 'Test262Error: Expected [p1, p2] and [p1] to have the same contents. '
    1870   strict mode: 'Test262Error: Expected [p1, p2] and [p1] to have the same contents. '
    18711865test/language/statements/for-in/scope-body-lex-open.js:
    18721866  default: 'Test262Error: Expected a ReferenceError to be thrown but no exception was thrown at all'

  • trunk/LayoutTests/ChangeLog

    r270873 r270874  
     12020-12-15  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        Non-enumerable property fails to shadow inherited enumerable property from for-in
     4        https://bugs.webkit.org/show_bug.cgi?id=38970
     5
     6        Reviewed by Keith Miller.
     7
     8        * platform/mac/fast/dom/wrapper-classes-objc-expected.txt:
     9        * platform/mac/fast/dom/wrapper-classes-objc.html:
     10
    1112020-12-15  Alex Christensen  <achristensen@webkit.org>
    212

  • trunk/LayoutTests/platform/mac/fast/dom/wrapper-classes-objc-expected.txt

    r209805 r270874  
    190190PASS objCObjectOfClass('NSArray') instanceof Array is true
    191191PASS concatenateArray(objCArrayOfString()) is 'onetwothree'
     192PASS objCArrayOfString().every((_, i, arr) => arr.propertyIsEnumerable(i)) is true
    192193PASS let arr = objCArrayOfString(); arr.length is 3
    193194PASS let arr = objCArrayOfString(); arr.length = 0 threw exception RangeError: Range error.

  • trunk/LayoutTests/platform/mac/fast/dom/wrapper-classes-objc.html

    r209805 r270874  
    287287
    288288    shouldBe("concatenateArray(objCArrayOfString())", "'onetwothree'");
     289    shouldBeTrue("objCArrayOfString().every((_, i, arr) => arr.propertyIsEnumerable(i))");
    289290
    290291    shouldBe("let arr = objCArrayOfString(); arr.length", "3");

  • trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h

    r267727 r270874  
    163163   
    164164    if (StringImpl* name = propertyName.uid()) {
     165        // FIXME: Set ReadOnly conditionally, based on setProperty presence in class inheritance chain.
     166        // https://bugs.webkit.org/show_bug.cgi?id=219924
     167        unsigned attributes = static_cast<unsigned>(PropertyAttribute::ReadOnly);
    165168        for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
    166169            // optional optimization to bypass getProperty in cases when we only need to know if the property exists
    … …  
    170173                JSLock::DropAllLocks dropAllLocks(globalObject);
    171174                if (hasProperty(ctx, thisRef, propertyNameRef.get())) {
    172                     slot.setCustom(thisObject, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, getCallbackGetter());
     175                    slot.setCustom(thisObject, attributes, getCallbackGetter());
    173176                    return true;
    174177                }
    … …  
    184187                if (exception) {
    185188                    throwException(globalObject, scope, toJS(globalObject, exception));
    186                     slot.setValue(thisObject, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, jsUndefined());
     189                    slot.setValue(thisObject, attributes, jsUndefined());
    187190                    return true;
    188191                }
    189192                if (value) {
    190                     slot.setValue(thisObject, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, toJS(globalObject, value));
     193                    slot.setValue(thisObject, attributes, toJS(globalObject, value));
    191194                    return true;
    192195                }
    … …  
    194197           
    195198            if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(globalObject)) {
    196                 if (staticValues->contains(name)) {
     199                if (StaticValueEntry* entry = staticValues->get(name)) {
     200                    // FIXME: getStaticValue() performs the same loop & checks just to acquire `entry`.
     201                    // https://bugs.webkit.org/show_bug.cgi?id=219925
    197202                    JSValue value = thisObject->getStaticValue(globalObject, propertyName);
    198203                    RETURN_IF_EXCEPTION(scope, false);
    199204                    if (value) {
    200                         slot.setValue(thisObject, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, value);
     205                        slot.setValue(thisObject, entry->attributes, value);
    201206                        return true;
    202207                    }
    … …  
    205210           
    206211            if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(globalObject)) {
    207                 if (staticFunctions->contains(name)) {
    208                     slot.setCustom(thisObject, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, getStaticFunctionGetter());
     212                if (StaticFunctionEntry* entry = staticFunctions->get(name)) {
     213                    slot.setCustom(thisObject, entry->attributes, getStaticFunctionGetter());
    209214                    return true;
    210215                }

  • trunk/Source/JavaScriptCore/API/tests/testapi.c

    r263117 r270874  
    10181018static JSStaticValue globalObject_staticValues[] = {
    10191019    { "globalStaticValue", globalObject_get, globalObject_set, kJSPropertyAttributeNone },
     1020    { "globalStaticValue2", globalObject_get, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontEnum },
    10201021    { 0, 0, 0, 0 }
    10211022};
    … …  
    10241025    { "globalStaticFunction", globalObject_call, kJSPropertyAttributeNone },
    10251026    { "globalStaticFunction2", globalObject_call, kJSPropertyAttributeNone },
     1027    { "globalStaticFunction3", globalObject_call, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontEnum },
    10261028    { "gc", functionGC, kJSPropertyAttributeNone },
    10271029    { 0, 0, 0 }

  • trunk/Source/JavaScriptCore/API/tests/testapiScripts/testapi.js

    r266030 r270874  
    8585shouldBe("this.globalStaticFunction2();", 20);
    8686
     87var globalStaticValue2Descriptor = Object.getOwnPropertyDescriptor(this, "globalStaticValue2");
     88shouldBe('typeof globalStaticValue2Descriptor', "object");
     89shouldBe('globalStaticValue2Descriptor.writable', false);
     90shouldBe('globalStaticValue2Descriptor.enumerable', false);
     91
     92var globalStaticFunction3Descriptor = Object.getOwnPropertyDescriptor(this, "globalStaticFunction3");
     93shouldBe('typeof globalStaticFunction3Descriptor', "object");
     94shouldBe('globalStaticFunction3Descriptor.writable', false);
     95shouldBe('globalStaticFunction3Descriptor.enumerable', false);
     96
    8797function iAmNotAStaticFunction() { return 10; }
    8898shouldBe("iAmNotAStaticFunction();", 10);
    … …  
    135145shouldBe('alwaysOneDescriptor.value', MyObject.alwaysOne);
    136146shouldBe('alwaysOneDescriptor.configurable', true);
    137 shouldBe('alwaysOneDescriptor.enumerable', false); // Actually it is.
     147shouldBe('alwaysOneDescriptor.enumerable', true);
    138148var cantFindDescriptor = Object.getOwnPropertyDescriptor(MyObject, "cantFind");
    139149shouldBe('typeof cantFindDescriptor', "object");
    140150shouldBe('cantFindDescriptor.value', MyObject.cantFind);
    141151shouldBe('cantFindDescriptor.configurable', true);
    142 shouldBe('cantFindDescriptor.enumerable', false);
     152shouldBe('cantFindDescriptor.enumerable', true);
    143153try {
    144154    // If getOwnPropertyDescriptor() returned an access descriptor, this wouldn't throw.
    … …  
    151161shouldBe('myPropertyNameDescriptor.value', MyObject.myPropertyName);
    152162shouldBe('myPropertyNameDescriptor.configurable', true);
    153 shouldBe('myPropertyNameDescriptor.enumerable', false); // Actually it is.
     163shouldBe('myPropertyNameDescriptor.enumerable', true);
    154164try {
    155165    // if getOwnPropertyDescriptor() returned an access descriptor, this wouldn't throw.
    … …  
    238248shouldBe('baseDupDescriptor.value', derived.baseDup);
    239249shouldBe('baseDupDescriptor.configurable', true);
    240 shouldBe('baseDupDescriptor.enumerable', false);
     250shouldBe('baseDupDescriptor.enumerable', true);
    241251var baseOnlyDescriptor = Object.getOwnPropertyDescriptor(derived, "baseOnly");
    242252shouldBe('typeof baseOnlyDescriptor', "object");
    243253shouldBe('baseOnlyDescriptor.value', derived.baseOnly);
    244254shouldBe('baseOnlyDescriptor.configurable', true);
    245 shouldBe('baseOnlyDescriptor.enumerable', false);
     255shouldBe('baseOnlyDescriptor.enumerable', true);
    246256shouldBe('Object.getOwnPropertyDescriptor(derived, "protoOnly")', undefined);
    247257var protoDupDescriptor = Object.getOwnPropertyDescriptor(derived, "protoDup");
    … …  
    249259shouldBe('protoDupDescriptor.value', derived.protoDup);
    250260shouldBe('protoDupDescriptor.configurable', true);
    251 shouldBe('protoDupDescriptor.enumerable', false);
     261shouldBe('protoDupDescriptor.enumerable', true);
    252262var derivedOnlyDescriptor = Object.getOwnPropertyDescriptor(derived, "derivedOnly");
    253263shouldBe('typeof derivedOnlyDescriptor', "object");
    254264shouldBe('derivedOnlyDescriptor.value', derived.derivedOnly);
    255265shouldBe('derivedOnlyDescriptor.configurable', true);
    256 shouldBe('derivedOnlyDescriptor.enumerable', false);
     266shouldBe('derivedOnlyDescriptor.enumerable', true);
    257267
    258268shouldBe("undefined instanceof MyObject", false);

  • trunk/Source/JavaScriptCore/ChangeLog

    r270870 r270874  
     12020-12-15  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        Non-enumerable property fails to shadow inherited enumerable property from for-in
     4        https://bugs.webkit.org/show_bug.cgi?id=38970
     5
     6        Reviewed by Keith Miller.
     7
     8        While for/in was initially specified with notion of "shadowing", it wasn't clarified
     9        until ES5 that [[Enumerable]] attributes are ignored when determining if a property
     10        has already been processed. Recently, for/in spec was expanded [1] to pin down common
     11        case enumeration as it's currently implemented by V8 and SpiderMonkey.
     12
     13        Since keeping track of DontEnum properties is a massive slowdown for uncached runs
     14        (with any data structure used), this patch simply adds [[Enumerable]] check to
     15        has_{indexed,structure,generic}_property bytecode ops and does renaming chores.
     16
     17        Common code is now shared between HasIndexedProperty (emitted for `0 in arr`) and
     18        HasEnumerableIndexedProperty DFG nodes via passing different slow path ops rather
     19        than having OpInfo with PropertySlot::InternalMethodType, which is a nice refactor.
     20
     21        While this change aligns common case for/in enumeration with the spec and other
     22        engines, it also introduces a few observable discrepancies from V8 and SpiderMonkey,
     23        which are permitted by the spec [2]:
     24        a) properties that have been redefined as DontEnum within loop body are skipped,
     25           which matches the spec [3] and seems like expected behavior;
     26        b) "shadowing" is broken if a DontEnum property of already visited object is
     27           added / deleted / redefined within loop body, which (pretty much) never happens.
     28
     29        This patch introduces a new invariant: all properties getOwn*PropertyNames() returns
     30        in DontEnumPropertiesMode::Exclude should be reported as [[Enumerable]] by
     31        getOwnPropertySlot(). JSCallbackObject and RuntimeArray are fixed to follow it.
     32
     33        for/in and Object.keys microbenchmarks are neutral. This change does not affect
     34        JSPropertyNameEnumerator caching, nor fast paths of its bytecodes.
     35
     36        [1]: https://github.com/tc39/ecma262/pull/1791
     37        [2]: https://tc39.es/ecma262/#sec-enumerate-object-properties (last paragraph)
     38        [3]: https://tc39.es/ecma262/#sec-%foriniteratorprototype%.next (step 7.b.iii)
     39
     40        * API/JSCallbackObjectFunctions.h:
     41        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
     42        * API/tests/testapi.c:
     43        * API/tests/testapiScripts/testapi.js:
     44        * bytecode/BytecodeList.rb:
     45        * bytecode/BytecodeUseDef.cpp:
     46        (JSC::computeUsesForBytecodeIndexImpl):
     47        (JSC::computeDefsForBytecodeIndexImpl):
     48        * bytecode/CodeBlock.cpp:
     49        (JSC::CodeBlock::finishCreation):
     50        * bytecode/Opcode.h:
     51        * bytecompiler/BytecodeGenerator.cpp:
     52        (JSC::BytecodeGenerator::emitHasEnumerableIndexedProperty):
     53        (JSC::BytecodeGenerator::emitHasEnumerableStructureProperty):
     54        (JSC::BytecodeGenerator::emitHasEnumerableProperty):
     55        (JSC::BytecodeGenerator::emitHasGenericProperty): Deleted.
     56        (JSC::BytecodeGenerator::emitHasIndexedProperty): Deleted.
     57        (JSC::BytecodeGenerator::emitHasStructureProperty): Deleted.
     58        * bytecompiler/BytecodeGenerator.h:
     59        * bytecompiler/NodesCodegen.cpp:
     60        (JSC::ForInNode::emitBytecode):
     61        * dfg/DFGAbstractInterpreterInlines.h:
     62        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     63        * dfg/DFGByteCodeParser.cpp:
     64        (JSC::DFG::ByteCodeParser::parseBlock):
     65        * dfg/DFGCapabilities.cpp:
     66        (JSC::DFG::capabilityLevel):
     67        * dfg/DFGClobberize.h:
     68        (JSC::DFG::clobberize):
     69        * dfg/DFGDoesGC.cpp:
     70        (JSC::DFG::doesGC):
     71        * dfg/DFGFixupPhase.cpp:
     72        (JSC::DFG::FixupPhase::fixupNode):
     73        (JSC::DFG::FixupPhase::convertToHasIndexedProperty):
     74        * dfg/DFGNode.h:
     75        (JSC::DFG::Node::hasArrayMode):
     76        (JSC::DFG::Node::hasInternalMethodType const): Deleted.
     77        (JSC::DFG::Node::internalMethodType const): Deleted.
     78        (JSC::DFG::Node::setInternalMethodType): Deleted.
     79        * dfg/DFGNodeType.h:
     80        * dfg/DFGOperations.cpp:
     81        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
     82        * dfg/DFGOperations.h:
     83        * dfg/DFGPredictionPropagationPhase.cpp:
     84        * dfg/DFGSSALoweringPhase.cpp:
     85        (JSC::DFG::SSALoweringPhase::handleNode):
     86        * dfg/DFGSafeToExecute.h:
     87        (JSC::DFG::safeToExecute):
     88        * dfg/DFGSpeculativeJIT.cpp:
     89        (JSC::DFG::SpeculativeJIT::compileHasEnumerableProperty):
     90        (JSC::DFG::SpeculativeJIT::compileHasEnumerableStructureProperty):
     91        (JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
     92        (JSC::DFG::SpeculativeJIT::compileHasGenericProperty): Deleted.
     93        (JSC::DFG::SpeculativeJIT::compileHasStructureProperty): Deleted.
     94        * dfg/DFGSpeculativeJIT.h:
     95        * dfg/DFGSpeculativeJIT32_64.cpp:
     96        (JSC::DFG::SpeculativeJIT::compile):
     97        * dfg/DFGSpeculativeJIT64.cpp:
     98        (JSC::DFG::SpeculativeJIT::compile):
     99        * ftl/FTLCapabilities.cpp:
     100        (JSC::FTL::canCompile):
     101        * ftl/FTLLowerDFGToB3.cpp:
     102        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
     103        (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
     104        (JSC::FTL::DFG::LowerDFGToB3::compileHasEnumerableProperty):
     105        (JSC::FTL::DFG::LowerDFGToB3::compileHasEnumerableStructureProperty):
     106        (JSC::FTL::DFG::LowerDFGToB3::compileHasGenericProperty): Deleted.
     107        (JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty): Deleted.
     108        * jit/JIT.cpp:
     109        (JSC::JIT::privateCompileMainPass):
     110        (JSC::JIT::privateCompileSlowCases):
     111        * jit/JIT.h:
     112        * jit/JITOpcodes.cpp:
     113        (JSC::JIT::emit_op_has_enumerable_structure_property):
     114        (JSC::JIT::emit_op_has_enumerable_indexed_property):
     115        (JSC::JIT::emitSlow_op_has_enumerable_indexed_property):
     116        (JSC::JIT::emit_op_has_structure_property): Deleted.
     117        (JSC::JIT::emit_op_has_indexed_property): Deleted.
     118        (JSC::JIT::emitSlow_op_has_indexed_property): Deleted.
     119        * jit/JITOpcodes32_64.cpp:
     120        (JSC::JIT::emit_op_has_enumerable_structure_property):
     121        (JSC::JIT::emit_op_has_enumerable_indexed_property):
     122        (JSC::JIT::emitSlow_op_has_enumerable_indexed_property):
     123        (JSC::JIT::emit_op_has_structure_property): Deleted.
     124        (JSC::JIT::emit_op_has_indexed_property): Deleted.
     125        (JSC::JIT::emitSlow_op_has_indexed_property): Deleted.
     126        * jit/JITOperations.cpp:
     127        (JSC::JSC_DEFINE_JIT_OPERATION):
     128        * jit/JITOperations.h:
     129        * llint/LowLevelInterpreter.asm:
     130        * llint/LowLevelInterpreter64.asm:
     131        * runtime/CommonSlowPaths.cpp:
     132        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
     133        * runtime/CommonSlowPaths.h:
     134        * runtime/JSObject.cpp:
     135        (JSC::JSObject::hasProperty const):
     136        (JSC::JSObject::hasEnumerableProperty const):
     137        (JSC::JSObject::hasPropertyGeneric const): Deleted.
     138        * runtime/JSObject.h:
     139
    11402020-12-15  Saam Barati  <sbarati@apple.com>
    2141

  • trunk/Source/JavaScriptCore/bytecode/BytecodeList.rb

    r270855 r270874  
    11261126    }
    11271127
    1128 op :has_indexed_property,
     1128op :has_enumerable_indexed_property,
    11291129    args: {
    11301130        dst: VirtualRegister,
    … …  
    11361136    }
    11371137
    1138 op :has_structure_property,
     1138op :has_enumerable_structure_property,
    11391139    args: {
    11401140        dst: VirtualRegister,
    … …  
    11601160    }
    11611161
    1162 op :has_generic_property,
     1162op :has_enumerable_property,
    11631163    args: {
    11641164        dst: VirtualRegister,

  • trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp

    r267489 r270874  
    222222    USES(OpNewArrayBuffer, immutableButterfly)
    223223
    224     USES(OpHasGenericProperty, base, property)
    225     USES(OpHasIndexedProperty, base, property)
     224    USES(OpHasEnumerableIndexedProperty, base, property)
     225    USES(OpHasEnumerableStructureProperty, base, property, enumerator)
     226    USES(OpHasEnumerableProperty, base, property)
    226227    USES(OpEnumeratorStructurePname, enumerator, index)
    227228    USES(OpEnumeratorGenericPname, enumerator, index)
    … …  
    261262    USES(OpGetByValWithThis, base, thisValue, property)
    262263    USES(OpInstanceofCustom, value, constructor, hasInstanceValue)
    263     USES(OpHasStructureProperty, base, property, enumerator)
    264264    USES(OpHasOwnStructureProperty, base, property, enumerator)
    265265    USES(OpInStructureProperty, base, property, enumerator)
    … …  
    421421    DEFS(OpToIndexString, dst)
    422422    DEFS(OpGetEnumerableLength, dst)
    423     DEFS(OpHasIndexedProperty, dst)
    424     DEFS(OpHasStructureProperty, dst)
     423    DEFS(OpHasEnumerableIndexedProperty, dst)
     424    DEFS(OpHasEnumerableStructureProperty, dst)
     425    DEFS(OpHasEnumerableProperty, dst)
    425426    DEFS(OpHasOwnStructureProperty, dst)
    426427    DEFS(OpInStructureProperty, dst)
    427     DEFS(OpHasGenericProperty, dst)
    428428    DEFS(OpGetDirectPname, dst)
    429429    DEFS(OpGetPropertyEnumerator, dst)

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r268077 r270874  
    504504        m_bytecodeCost += opcodeLengths[opcodeID];
    505505        switch (opcodeID) {
    506         LINK(OpHasIndexedProperty)
     506        LINK(OpHasEnumerableIndexedProperty)
    507507
    508508        LINK(OpCallVarargs, profile)

  • trunk/Source/JavaScriptCore/bytecode/Opcode.h

    r263035 r270874  
    127127
    128128#define FOR_EACH_OPCODE_WITH_ARRAY_PROFILE(macro) \
    129     macro(OpHasIndexedProperty) \
     129    macro(OpHasEnumerableIndexedProperty) \
    130130    macro(OpCallVarargs) \
    131131    macro(OpTailCallVarargs) \

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r270870 r270874  
    43664366}
    43674367
    4368 RegisterID* BytecodeGenerator::emitHasGenericProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName)
    4369 {
    4370     OpHasGenericProperty::emit(this, dst, base, propertyName);
    4371     return dst;
    4372 }
    4373 
    4374 RegisterID* BytecodeGenerator::emitHasIndexedProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName)
    4375 {
    4376     OpHasIndexedProperty::emit(this, dst, base, propertyName);
    4377     return dst;
    4378 }
    4379 
    4380 RegisterID* BytecodeGenerator::emitHasStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator)
    4381 {
    4382     OpHasStructureProperty::emit(this, dst, base, propertyName, enumerator);
     4368RegisterID* BytecodeGenerator::emitHasEnumerableIndexedProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName)
     4369{
     4370    OpHasEnumerableIndexedProperty::emit(this, dst, base, propertyName);
     4371    return dst;
     4372}
     4373
     4374RegisterID* BytecodeGenerator::emitHasEnumerableStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator)
     4375{
     4376    OpHasEnumerableStructureProperty::emit(this, dst, base, propertyName, enumerator);
     4377    return dst;
     4378}
     4379
     4380RegisterID* BytecodeGenerator::emitHasEnumerableProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName)
     4381{
     4382    OpHasEnumerableProperty::emit(this, dst, base, propertyName);
    43834383    return dst;
    43844384}

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

    r270870 r270874  
    903903        void emitCheckTraps();
    904904
    905         RegisterID* emitHasIndexedProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName);
    906         RegisterID* emitHasStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator);
     905        RegisterID* emitHasEnumerableIndexedProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName);
     906        RegisterID* emitHasEnumerableStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator);
     907        RegisterID* emitHasEnumerableProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName);
    907908        RegisterID* emitHasOwnStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator);
    908         RegisterID* emitHasGenericProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName);
    909909        RegisterID* emitGetPropertyEnumerator(RegisterID* dst, RegisterID* base);
    910910        RegisterID* emitGetEnumerableLength(RegisterID* dst, RegisterID* base);

  • trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

    r269939 r270874  
    39633963        RefPtr<RegisterID> result = generator.emitEqualityOp<OpLess>(generator.newTemporary(), i.get(), length.get());
    39643964        generator.emitJumpIfFalse(result.get(), loopEnd.get());
    3965         generator.emitHasIndexedProperty(result.get(), base.get(), i.get());
     3965        generator.emitHasEnumerableIndexedProperty(result.get(), base.get(), i.get());
    39663966        generator.emitJumpIfFalse(result.get(), *scope->continueTarget());
    39673967
    … …  
    40044004        RefPtr<RegisterID> result = generator.emitIsNull(generator.newTemporary(), propertyName.get());
    40054005        generator.emitJumpIfTrue(result.get(), loopEnd.get());
    4006         generator.emitHasStructureProperty(result.get(), base.get(), propertyName.get(), enumerator.get());
     4006        generator.emitHasEnumerableStructureProperty(result.get(), base.get(), propertyName.get(), enumerator.get());
    40074007        generator.emitJumpIfFalse(result.get(), *scope->continueTarget());
    40084008
    … …  
    40464046        generator.emitJumpIfTrue(result.get(), loopEnd.get());
    40474047
    4048         generator.emitHasGenericProperty(result.get(), base.get(), propertyName.get());
     4048        generator.emitHasEnumerableProperty(result.get(), base.get(), propertyName.get());
    40494049        generator.emitJumpIfFalse(result.get(), *scope->continueTarget());
    40504050

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r269531 r270874  
    41564156        break;
    41574157    }
    4158     case HasGenericProperty: {
     4158    case HasEnumerableProperty: {
    41594159        setNonCellTypeForNode(node, SpecBoolean);
    41604160        clobberWorld();
    … …  
    41634163    case InStructureProperty:
    41644164    case HasOwnStructureProperty:
    4165     case HasStructureProperty: {
     4165    case HasEnumerableStructureProperty: {
    41664166        setNonCellTypeForNode(node, SpecBoolean);
    41674167        clobberWorld();
    41684168        break;
    41694169    }
    4170     case HasIndexedProperty: {
     4170    case HasIndexedProperty:
     4171    case HasEnumerableIndexedProperty: {
    41714172        ArrayMode mode = node->arrayMode();
    41724173        switch (mode.type()) {

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r269531 r270874  
    81408140        }
    81418141
    8142         case op_has_generic_property: {
    8143             auto bytecode = currentInstruction->as<OpHasGenericProperty>();
    8144             set(bytecode.m_dst, addToGraph(HasGenericProperty, get(bytecode.m_base), get(bytecode.m_property)));
    8145             NEXT_OPCODE(op_has_generic_property);
    8146         }
    8147 
    8148         case op_has_structure_property: {
    8149             auto bytecode = currentInstruction->as<OpHasStructureProperty>();
    8150             set(bytecode.m_dst, addToGraph(HasStructureProperty,
     8142        case op_has_enumerable_structure_property: {
     8143            auto bytecode = currentInstruction->as<OpHasEnumerableStructureProperty>();
     8144            set(bytecode.m_dst, addToGraph(HasEnumerableStructureProperty,
    81518145                get(bytecode.m_base),
    81528146                get(bytecode.m_property),
    81538147                get(bytecode.m_enumerator)));
    8154             NEXT_OPCODE(op_has_structure_property);
     8148            NEXT_OPCODE(op_has_enumerable_structure_property);
     8149        }
     8150
     8151        case op_has_enumerable_property: {
     8152            auto bytecode = currentInstruction->as<OpHasEnumerableProperty>();
     8153            set(bytecode.m_dst, addToGraph(HasEnumerableProperty, get(bytecode.m_base), get(bytecode.m_property)));
     8154            NEXT_OPCODE(op_has_enumerable_property);
    81558155        }
    81568156
    … …  
    81738173        }
    81748174
    8175         case op_has_indexed_property: {
    8176             auto bytecode = currentInstruction->as<OpHasIndexedProperty>();
     8175        case op_has_enumerable_indexed_property: {
     8176            auto bytecode = currentInstruction->as<OpHasEnumerableIndexedProperty>();
    81778177            Node* base = get(bytecode.m_base);
    81788178            ArrayMode arrayMode = getArrayMode(bytecode.metadata(codeBlock).m_arrayProfile, Array::Read);
    … …  
    81818181            addVarArgChild(property);
    81828182            addVarArgChild(nullptr);
    8183             Node* hasIterableProperty = addToGraph(Node::VarArg, HasIndexedProperty, OpInfo(arrayMode.asWord()), OpInfo(static_cast<uint32_t>(PropertySlot::InternalMethodType::GetOwnProperty)));
     8183            Node* hasIterableProperty = addToGraph(Node::VarArg, HasEnumerableIndexedProperty, OpInfo(arrayMode.asWord()));
    81848184            m_exitOK = false; // HasIndexedProperty must be treated as if it clobbers exit state, since FixupPhase may make it generic.
    81858185            set(bytecode.m_dst, hasIterableProperty);
    8186             NEXT_OPCODE(op_has_indexed_property);
     8186            NEXT_OPCODE(op_has_enumerable_indexed_property);
    81878187        }
    81888188

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r269349 r270874  
    254254    case op_get_from_scope:
    255255    case op_get_enumerable_length:
    256     case op_has_generic_property:
    257     case op_has_structure_property:
     256    case op_has_enumerable_indexed_property:
     257    case op_has_enumerable_structure_property:
     258    case op_has_enumerable_property:
    258259    case op_has_own_structure_property:
    259260    case op_in_structure_property:
    260     case op_has_indexed_property:
    261261    case op_get_direct_pname:
    262262    case op_get_property_enumerator:

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r269531 r270874  
    165165        case ArrayIndexOf:
    166166        case HasIndexedProperty:
     167        case HasEnumerableIndexedProperty:
    167168        case AtomicsAdd:
    168169        case AtomicsAnd:
    … …  
    349350    }
    350351
    351     case HasIndexedProperty: {
     352    case HasIndexedProperty:
     353    case HasEnumerableIndexedProperty: {
    352354        read(JSObject_butterfly);
    353355        ArrayMode mode = node->arrayMode();
    … …  
    706708    case ResolveScope:
    707709    case ToObject:
    708     case HasGenericProperty:
    709     case HasStructureProperty:
     710    case HasEnumerableStructureProperty:
     711    case HasEnumerableProperty:
    710712    case HasOwnStructureProperty:
    711713    case InStructureProperty:

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r269343 r270874  
    296296    case GetDynamicVar:
    297297    case GetMapBucket:
    298     case HasGenericProperty:
    299298    case HasIndexedProperty:
     299    case HasEnumerableIndexedProperty:
     300    case HasEnumerableStructureProperty:
     301    case HasEnumerableProperty:
    300302    case HasOwnProperty:
    301     case HasStructureProperty:
    302303    case HasOwnStructureProperty:
    303304    case InStructureProperty:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r269531 r270874  
    22052205            break;
    22062206        }
    2207         case HasGenericProperty: {
     2207        case HasEnumerableProperty: {
    22082208            fixEdge<CellUse>(node->child2());
    22092209            break;
    22102210        }
    2211         case HasStructureProperty: {
     2211        case HasEnumerableStructureProperty: {
    22122212            fixEdge<StringUse>(node->child2());
    22132213            fixEdge<KnownCellUse>(node->child3());
    … …  
    22212221            break;
    22222222        }
    2223         case HasIndexedProperty: {
     2223        case HasIndexedProperty:
     2224        case HasEnumerableIndexedProperty: {
    22242225            node->setArrayMode(
    22252226                node->arrayMode().refine(
    … …  
    39893990                m_graph.varArgChild(node, 1)->prediction(),
    39903991                SpecNone));
    3991         node->setInternalMethodType(PropertySlot::InternalMethodType::HasProperty);
    39923992
    39933993        blessArrayOperation(m_graph.varArgChild(node, 0), m_graph.varArgChild(node, 1), m_graph.varArgChild(node, 2));

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r270764 r270874  
    22152215        case ArrayIndexOf:
    22162216        case HasIndexedProperty:
     2217        case HasEnumerableIndexedProperty:
    22172218        case AtomicsAdd:
    22182219        case AtomicsAnd:
    … …  
    30043005    }
    30053006
    3006     bool hasInternalMethodType() const
    3007     {
    3008         return op() == HasIndexedProperty;
    3009     }
    3010 
    3011     PropertySlot::InternalMethodType internalMethodType() const
    3012     {
    3013         ASSERT(hasInternalMethodType());
    3014         return static_cast<PropertySlot::InternalMethodType>(m_opInfo2.as<uint32_t>());
    3015     }
    3016 
    3017     void setInternalMethodType(PropertySlot::InternalMethodType type)
    3018     {
    3019         ASSERT(hasInternalMethodType());
    3020         m_opInfo2 = static_cast<uint32_t>(type);
    3021     }
    3022 
    30233007    Node* replacement() const
    30243008    {

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r269531 r270874  
    499499    /* Must generate because of Proxies on the prototype chain */ \
    500500    macro(HasIndexedProperty, NodeMustGenerate | NodeResultBoolean | NodeHasVarArgs) \
    501     macro(HasStructureProperty, NodeResultBoolean) \
     501    macro(HasEnumerableIndexedProperty, NodeMustGenerate | NodeResultBoolean | NodeHasVarArgs) \
     502    macro(HasEnumerableStructureProperty, NodeResultBoolean) \
     503    macro(HasEnumerableProperty, NodeResultBoolean) \
    502504    macro(HasOwnStructureProperty, NodeResultBoolean | NodeMustGenerate) \
    503505    macro(InStructureProperty, NodeMustGenerate | NodeResultBoolean) \
    504     macro(HasGenericProperty, NodeResultBoolean) \
    505506    macro(GetDirectPname, NodeMustGenerate | NodeHasVarArgs | NodeResultJS) \
    506507    macro(GetPropertyEnumerator, NodeMustGenerate | NodeResultJS) \

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r268783 r270874  
    22592259}
    22602260
    2261 JSC_DEFINE_JIT_OPERATION(operationHasGenericProperty, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, JSCell* property))
     2261JSC_DEFINE_JIT_OPERATION(operationHasEnumerableProperty, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, JSCell* property))
    22622262{
    22632263    VM& vm = globalObject->vm();
    … …  
    22762276    auto propertyName = asString(property)->toIdentifier(globalObject);
    22772277    RETURN_IF_EXCEPTION(scope, { });
    2278     RELEASE_AND_RETURN(scope, JSValue::encode(jsBoolean(base->hasPropertyGeneric(globalObject, propertyName, PropertySlot::InternalMethodType::GetOwnProperty))));
     2278    RELEASE_AND_RETURN(scope, JSValue::encode(jsBoolean(base->hasEnumerableProperty(globalObject, propertyName))));
    22792279}
    22802280
    … …  
    23012301}
    23022302
    2303 JSC_DEFINE_JIT_OPERATION(operationHasIndexedPropertyByInt, size_t, (JSGlobalObject* globalObject, JSCell* baseCell, int32_t subscript, int32_t internalMethodType))
     2303JSC_DEFINE_JIT_OPERATION(operationHasIndexedProperty, size_t, (JSGlobalObject* globalObject, JSCell* baseCell, int32_t subscript))
    23042304{
    23052305    VM& vm = globalObject->vm();
    … …  
    23092309    if (UNLIKELY(subscript < 0)) {
    23102310        // Go the slowest way possible because negative indices don't use indexed storage.
    2311         return object->hasPropertyGeneric(globalObject, Identifier::from(vm, subscript), static_cast<PropertySlot::InternalMethodType>(internalMethodType));
    2312     }
    2313     return object->hasPropertyGeneric(globalObject, subscript, static_cast<PropertySlot::InternalMethodType>(internalMethodType));
     2311        return object->hasProperty(globalObject, Identifier::from(vm, subscript));
     2312    }
     2313    return object->hasProperty(globalObject, static_cast<unsigned>(subscript));
     2314}
     2315
     2316JSC_DEFINE_JIT_OPERATION(operationHasEnumerableIndexedProperty, size_t, (JSGlobalObject* globalObject, JSCell* baseCell, int32_t subscript))
     2317{
     2318    VM& vm = globalObject->vm();
     2319    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
     2320    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
     2321    JSObject* object = baseCell->toObject(globalObject);
     2322    if (UNLIKELY(subscript < 0)) {
     2323        // Go the slowest way possible because negative indices don't use indexed storage.
     2324        return object->hasEnumerableProperty(globalObject, Identifier::from(vm, subscript));
     2325    }
     2326    return object->hasEnumerableProperty(globalObject, subscript);
    23142327}
    23152328

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r268385 r270874  
    100100JSC_DECLARE_JIT_OPERATION(operationGetPrototypeOf, EncodedJSValue, (JSGlobalObject*, EncodedJSValue));
    101101JSC_DECLARE_JIT_OPERATION(operationGetPrototypeOfObject, EncodedJSValue, (JSGlobalObject*, JSObject*));
    102 JSC_DECLARE_JIT_OPERATION(operationHasGenericProperty, EncodedJSValue, (JSGlobalObject*, EncodedJSValue, JSCell*));
     102JSC_DECLARE_JIT_OPERATION(operationHasIndexedProperty, size_t, (JSGlobalObject*, JSCell*, int32_t));
     103JSC_DECLARE_JIT_OPERATION(operationHasEnumerableIndexedProperty, size_t, (JSGlobalObject*, JSCell*, int32_t));
     104JSC_DECLARE_JIT_OPERATION(operationHasEnumerableProperty, EncodedJSValue, (JSGlobalObject*, EncodedJSValue, JSCell*));
    103105JSC_DECLARE_JIT_OPERATION(operationHasOwnStructureProperty, EncodedJSValue, (JSGlobalObject*, JSCell*, JSString*));
    104106JSC_DECLARE_JIT_OPERATION(operationInStructureProperty, EncodedJSValue, (JSGlobalObject*, JSCell*, JSString*));
    105 JSC_DECLARE_JIT_OPERATION(operationHasIndexedPropertyByInt, size_t, (JSGlobalObject*, JSCell*, int32_t, int32_t));
    106107JSC_DECLARE_JIT_OPERATION(operationGetPropertyEnumerator, JSCell*, (JSGlobalObject*, EncodedJSValue));
    107108JSC_DECLARE_JIT_OPERATION(operationGetPropertyEnumeratorCell, JSCell*, (JSGlobalObject*, JSCell*));

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r269343 r270874  
    12131213            break;
    12141214        }
    1215         case HasGenericProperty:
    1216         case HasStructureProperty:
    12171215        case HasOwnStructureProperty:
    12181216        case InStructureProperty:
    1219         case HasIndexedProperty: {
     1217        case HasIndexedProperty:
     1218        case HasEnumerableIndexedProperty:
     1219        case HasEnumerableStructureProperty:
     1220        case HasEnumerableProperty: {
    12201221            setPrediction(SpecBoolean);
    12211222            break;

  • trunk/Source/JavaScriptCore/dfg/DFGSSALoweringPhase.cpp

    r269531 r270874  
    8383
    8484        case HasIndexedProperty:
     85        case HasEnumerableIndexedProperty:
    8586            lowerBoundsCheck(m_graph.child(m_node, 0), m_graph.child(m_node, 1), m_graph.child(m_node, 2));
    8687            break;

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r269343 r270874  
    293293    case FiatInt52:
    294294    case HasIndexedProperty:
     295    case HasEnumerableIndexedProperty:
    295296    case GetEnumeratorStructurePname:
    296297    case GetEnumeratorGenericPname:
    … …  
    629630    case MultiDeleteByOffset:
    630631    case GetEnumerableLength:
    631     case HasGenericProperty:
    632     case HasStructureProperty:
     632    case HasEnumerableStructureProperty:
     633    case HasEnumerableProperty:
    633634    case HasOwnStructureProperty:
    634635    case InStructureProperty:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r270764 r270874  
    1283912839}
    1284012840
    12841 void SpeculativeJIT::compileHasGenericProperty(Node* node)
     12841void SpeculativeJIT::compileHasEnumerableProperty(Node* node)
    1284212842{
    1284312843    JSValueOperand base(this, node->child1());
    … …  
    1285012850    JSValueRegsFlushedCallResult result(this);
    1285112851    JSValueRegs resultRegs = result.regs();
    12852     callOperation(operationHasGenericProperty, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyGPR);
     12852    callOperation(operationHasEnumerableProperty, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyGPR);
    1285312853    m_jit.exceptionCheck();
    1285412854    blessedBooleanResult(resultRegs.payloadGPR(), node);
    … …  
    1299012990}
    1299112991
    12992 void SpeculativeJIT::compileHasStructureProperty(Node* node)
     12992void SpeculativeJIT::compileHasEnumerableStructureProperty(Node* node)
    1299312993{
    1299412994    JSValueOperand base(this, node->child1());
    … …  
    1301213012    moveTrueTo(resultRegs.payloadGPR());
    1301313013
    13014     addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyGPR));
     13014    addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasEnumerableProperty, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyGPR));
    1301513015    blessedBooleanResult(resultRegs.payloadGPR(), node);
    1301613016}
    … …  
    1426814268}
    1426914269
    14270 void SpeculativeJIT::compileHasIndexedProperty(Node* node)
     14270void SpeculativeJIT::compileHasIndexedProperty(Node* node, S_JITOperation_GCZ slowPathOperation)
    1427114271{
    1427214272    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
    … …  
    1438414384    }
    1438514385
    14386     addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedPropertyByInt, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, indexGPR, static_cast<int32_t>(node->internalMethodType())));
     14386    addSlowPathGenerator(slowPathCall(slowCases, this, slowPathOperation, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, indexGPR));
    1438714387
    1438814388    unblessedBooleanResult(resultGPR, node);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r269343 r270874  
    14471447    void compileThrowStaticError(Node*);
    14481448    void compileGetEnumerableLength(Node*);
    1449     void compileHasGenericProperty(Node*);
     1449    void compileHasEnumerableStructureProperty(Node*);
     1450    void compileHasEnumerableProperty(Node*);
    14501451    void compileToIndexString(Node*);
    14511452    void compilePutByIdFlush(Node*);
    … …  
    14531454    void compilePutByIdDirect(Node*);
    14541455    void compilePutByIdWithThis(Node*);
    1455     void compileHasStructureProperty(Node*);
    14561456    template <typename Function>
    14571457    void compileHasOwnStructurePropertyImpl(Node*, Function);
    … …  
    14891489    void compileLogShadowChickenPrologue(Node*);
    14901490    void compileLogShadowChickenTail(Node*);
    1491     void compileHasIndexedProperty(Node*);
     1491    void compileHasIndexedProperty(Node*, S_JITOperation_GCZ);
    14921492    void compileExtractCatchLocal(Node*);
    14931493    void compileClearCatchLocals(Node*);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r269343 r270874  
    40744074        break;
    40754075    }
    4076     case HasGenericProperty: {
    4077         compileHasGenericProperty(node);
    4078         break;
    4079     }
    4080     case HasStructureProperty: {
    4081         compileHasStructureProperty(node);
     4076    case HasEnumerableStructureProperty: {
     4077        compileHasEnumerableStructureProperty(node);
     4078        break;
     4079    }
     4080    case HasEnumerableProperty: {
     4081        compileHasEnumerableProperty(node);
    40824082        break;
    40834083    }
    … …  
    40914091    }
    40924092    case HasIndexedProperty: {
    4093         compileHasIndexedProperty(node);
     4093        compileHasIndexedProperty(node, operationHasIndexedProperty);
     4094        break;
     4095    }
     4096    case HasEnumerableIndexedProperty: {
     4097        compileHasIndexedProperty(node, operationHasEnumerableIndexedProperty);
    40944098        break;
    40954099    }

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r269531 r270874  
    51215121        break;
    51225122    }
    5123     case HasGenericProperty: {
    5124         compileHasGenericProperty(node);
    5125         break;
    5126     }
    5127     case HasStructureProperty: {
    5128         compileHasStructureProperty(node);
     5123    case HasEnumerableStructureProperty: {
     5124        compileHasEnumerableStructureProperty(node);
     5125        break;
     5126    }
     5127    case HasEnumerableProperty: {
     5128        compileHasEnumerableProperty(node);
    51295129        break;
    51305130    }
    … …  
    51385138    }
    51395139    case HasIndexedProperty: {
    5140         compileHasIndexedProperty(node);
     5140        compileHasIndexedProperty(node, operationHasIndexedProperty);
     5141        break;
     5142    }
     5143    case HasEnumerableIndexedProperty: {
     5144        compileHasIndexedProperty(node, operationHasEnumerableIndexedProperty);
    51415145        break;
    51425146    }

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r269343 r270874  
    281281    case Int52Constant:
    282282    case BooleanToNumber:
    283     case HasGenericProperty:
    284     case HasStructureProperty:
     283    case HasIndexedProperty:
     284    case HasEnumerableIndexedProperty:
     285    case HasEnumerableStructureProperty:
     286    case HasEnumerableProperty:
    285287    case HasOwnStructureProperty:
    286288    case InStructureProperty:
    287     case HasIndexedProperty:
    288289    case GetDirectPname:
    289290    case GetEnumerableLength:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r270764 r270874  
    15011501            break;
    15021502        case HasIndexedProperty:
    1503             compileHasIndexedProperty();
    1504             break;
    1505         case HasGenericProperty:
    1506             compileHasGenericProperty();
    1507             break;
    1508         case HasStructureProperty:
    1509             compileHasStructureProperty();
     1503            compileHasIndexedProperty(operationHasIndexedProperty);
     1504            break;
     1505        case HasEnumerableIndexedProperty:
     1506            compileHasIndexedProperty(operationHasEnumerableIndexedProperty);
     1507            break;
     1508        case HasEnumerableStructureProperty:
     1509            compileHasEnumerableStructureProperty();
     1510            break;
     1511        case HasEnumerableProperty:
     1512            compileHasEnumerableProperty();
    15101513            break;
    15111514        case HasOwnStructureProperty:
    … …  
    1249312496    }
    1249412497   
    12495     void compileHasIndexedProperty()
     12498    void compileHasIndexedProperty(S_JITOperation_GCZ slowPathOperation)
    1249612499    {
    1249712500        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_origin.semantic);
    … …  
    1250412507        case Array::Contiguous: {
    1250512508            LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
    12506             LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
    1250712509
    1250812510            IndexedAbstractHeap& heap = mode.type() == Array::Int32 ?
    … …  
    1253512537            m_out.appendTo(slowCase, continuation);
    1253612538            ValueFromBlock slowResult = m_out.anchor(
    12537                 m_out.notZero64(vmCall(Int64, operationHasIndexedPropertyByInt, weakPointer(globalObject), base, index, internalMethodType)));
     12539                m_out.notZero64(vmCall(Int64, slowPathOperation, weakPointer(globalObject), base, index)));
    1253812540            m_out.jump(continuation);
    1253912541
    … …  
    1254412546        case Array::Double: {
    1254512547            LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
    12546             LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
    1254712548           
    1254812549            IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
    … …  
    1257412575            m_out.appendTo(slowCase, continuation);
    1257512576            ValueFromBlock slowResult = m_out.anchor(
    12576                 m_out.notZero64(vmCall(Int64, operationHasIndexedPropertyByInt, weakPointer(globalObject), base, index, internalMethodType)));
     12577                m_out.notZero64(vmCall(Int64, slowPathOperation, weakPointer(globalObject), base, index)));
    1257712578            m_out.jump(continuation);
    1257812579           
    … …  
    1258412585        case Array::ArrayStorage: {
    1258512586            LValue storage = lowStorage(m_graph.varArgChild(m_node, 2));
    12586             LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
    1258712587
    1258812588            LBasicBlock slowCase = m_out.newBlock();
    … …  
    1261212612            m_out.appendTo(slowCase, continuation);
    1261312613            ValueFromBlock slowResult = m_out.anchor(
    12614                 m_out.notZero64(vmCall(Int64, operationHasIndexedPropertyByInt, weakPointer(globalObject), base, index, internalMethodType)));
     12614                m_out.notZero64(vmCall(Int64, slowPathOperation, weakPointer(globalObject), base, index)));
    1261512615            m_out.jump(continuation);
    1261612616
    … …  
    1262112621
    1262212622        default: {
    12623             LValue internalMethodType = m_out.constInt32(static_cast<int32_t>(m_node->internalMethodType()));
    12624             setBoolean(m_out.notZero64(vmCall(Int64, operationHasIndexedPropertyByInt, weakPointer(globalObject), base, index, internalMethodType)));
    12625             break;
    12626         }
    12627         }
    12628     }
    12629 
    12630     void compileHasGenericProperty()
     12623            setBoolean(m_out.notZero64(vmCall(Int64, slowPathOperation, weakPointer(globalObject), base, index)));
     12624            break;
     12625        }
     12626        }
     12627    }
     12628
     12629    void compileHasEnumerableProperty()
    1263112630    {
    1263212631        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_origin.semantic);
    1263312632        LValue base = lowJSValue(m_node->child1());
    1263412633        LValue property = lowCell(m_node->child2());
    12635         setJSValue(vmCall(Int64, operationHasGenericProperty, weakPointer(globalObject), base, property));
     12634        setJSValue(vmCall(Int64, operationHasEnumerableProperty, weakPointer(globalObject), base, property));
    1263612635    }
    1263712636
    … …  
    1267312672    }
    1267412673
    12675     void compileHasStructureProperty()
    12676     {
    12677         compileHasStructurePropertyImpl(lowJSValue(m_node->child1()), operationHasGenericProperty);
     12674    void compileHasEnumerableStructureProperty()
     12675    {
     12676        compileHasStructurePropertyImpl(lowJSValue(m_node->child1()), operationHasEnumerableProperty);
    1267812677    }
    1267912678

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r270711 r270874  
    305305        DEFINE_SLOW_OP(spread)
    306306        DEFINE_SLOW_OP(get_enumerable_length)
    307         DEFINE_SLOW_OP(has_generic_property)
     307        DEFINE_SLOW_OP(has_enumerable_property)
    308308        DEFINE_SLOW_OP(get_property_enumerator)
    309309        DEFINE_SLOW_OP(to_index_string)
    … …  
    464464        DEFINE_OP(op_put_to_arguments)
    465465
    466         DEFINE_OP(op_has_structure_property)
     466        DEFINE_OP(op_has_enumerable_indexed_property)
     467        DEFINE_OP(op_has_enumerable_structure_property)
    467468        DEFINE_OP(op_has_own_structure_property)
    468469        DEFINE_OP(op_in_structure_property)
    469         DEFINE_OP(op_has_indexed_property)
    470470        DEFINE_OP(op_get_direct_pname)
    471471        DEFINE_OP(op_enumerator_structure_pname)
    … …  
    593593        DEFINE_SLOWCASE_OP(op_del_by_id)
    594594        DEFINE_SLOWCASE_OP(op_sub)
    595         DEFINE_SLOWCASE_OP(op_has_indexed_property)
     595        DEFINE_SLOWCASE_OP(op_has_enumerable_indexed_property)
    596596        DEFINE_SLOWCASE_OP(op_get_from_scope)
    597597        DEFINE_SLOWCASE_OP(op_put_to_scope)
    … …  
    626626        DEFINE_SLOWCASE_SLOW_OP(get_direct_pname)
    627627        DEFINE_SLOWCASE_SLOW_OP(get_prototype_of)
    628         DEFINE_SLOWCASE_SLOW_OP(has_structure_property)
     628        DEFINE_SLOWCASE_SLOW_OP(has_enumerable_structure_property)
    629629        DEFINE_SLOWCASE_SLOW_OP(has_own_structure_property)
    630630        DEFINE_SLOWCASE_SLOW_OP(in_structure_property)

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r270711 r270874  
    666666        template <typename OpCodeType>
    667667        void emit_op_has_structure_propertyImpl(const Instruction*);
    668         void emit_op_has_structure_property(const Instruction*);
     668        void emit_op_has_enumerable_indexed_property(const Instruction*);
     669        void emit_op_has_enumerable_structure_property(const Instruction*);
    669670        void emit_op_has_own_structure_property(const Instruction*);
    670671        void emit_op_in_structure_property(const Instruction*);
    671         void emit_op_has_indexed_property(const Instruction*);
    672672        void emit_op_get_direct_pname(const Instruction*);
    673673        void emit_op_enumerator_structure_pname(const Instruction*);
    … …  
    724724        void emitSlow_op_put_private_name(const Instruction*, Vector<SlowCaseEntry>::iterator&);
    725725        void emitSlow_op_sub(const Instruction*, Vector<SlowCaseEntry>::iterator&);
    726         void emitSlow_op_has_indexed_property(const Instruction*, Vector<SlowCaseEntry>::iterator&);
     726        void emitSlow_op_has_enumerable_indexed_property(const Instruction*, Vector<SlowCaseEntry>::iterator&);
    727727
    728728        void emit_op_resolve_scope(const Instruction*);

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r270711 r270874  
    13931393}
    13941394
    1395 void JIT::emit_op_has_structure_property(const Instruction* currentInstruction)
    1396 {
    1397     emit_op_has_structure_propertyImpl<OpHasStructureProperty>(currentInstruction);
     1395void JIT::emit_op_has_enumerable_structure_property(const Instruction* currentInstruction)
     1396{
     1397    emit_op_has_structure_propertyImpl<OpHasEnumerableStructureProperty>(currentInstruction);
    13981398}
    13991399
    … …  
    14351435}
    14361436
    1437 void JIT::emit_op_has_indexed_property(const Instruction* currentInstruction)
    1438 {
    1439     auto bytecode = currentInstruction->as<OpHasIndexedProperty>();
     1437void JIT::emit_op_has_enumerable_indexed_property(const Instruction* currentInstruction)
     1438{
     1439    auto bytecode = currentInstruction->as<OpHasEnumerableIndexedProperty>();
    14401440    auto& metadata = bytecode.metadata(m_codeBlock);
    14411441    VirtualRegister dst = bytecode.m_dst;
    … …  
    14821482}
    14831483
    1484 void JIT::emitSlow_op_has_indexed_property(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
     1484void JIT::emitSlow_op_has_enumerable_indexed_property(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    14851485{
    14861486    linkAllSlowCases(iter);
    14871487
    1488     auto bytecode = currentInstruction->as<OpHasIndexedProperty>();
     1488    auto bytecode = currentInstruction->as<OpHasEnumerableIndexedProperty>();
    14891489    VirtualRegister dst = bytecode.m_dst;
    14901490    VirtualRegister base = bytecode.m_base;

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r270711 r270874  
    11521152}
    11531153
    1154 void JIT::emit_op_has_structure_property(const Instruction* currentInstruction)
    1155 {
    1156     emit_op_has_structure_propertyImpl<OpHasStructureProperty>(currentInstruction);
     1154void JIT::emit_op_has_enumerable_structure_property(const Instruction* currentInstruction)
     1155{
     1156    emit_op_has_structure_propertyImpl<OpHasEnumerableStructureProperty>(currentInstruction);
    11571157}
    11581158
    … …  
    11941194}
    11951195
    1196 void JIT::emit_op_has_indexed_property(const Instruction* currentInstruction)
    1197 {
    1198     auto bytecode = currentInstruction->as<OpHasIndexedProperty>();
     1196void JIT::emit_op_has_enumerable_indexed_property(const Instruction* currentInstruction)
     1197{
     1198    auto bytecode = currentInstruction->as<OpHasEnumerableIndexedProperty>();
    11991199    auto& metadata = bytecode.metadata(m_codeBlock);
    12001200    VirtualRegister dst = bytecode.m_dst;
    … …  
    12411241}
    12421242
    1243 void JIT::emitSlow_op_has_indexed_property(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
     1243void JIT::emitSlow_op_has_enumerable_indexed_property(const Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    12441244{
    12451245    linkAllSlowCases(iter);
    12461246
    1247     auto bytecode = currentInstruction->as<OpHasIndexedProperty>();
     1247    auto bytecode = currentInstruction->as<OpHasEnumerableIndexedProperty>();
    12481248    VirtualRegister dst = bytecode.m_dst;
    12491249    VirtualRegister base = bytecode.m_base;

  • trunk/Source/JavaScriptCore/jit/JITOperations.cpp

    r268794 r270874  
    24462446    if (!CommonSlowPaths::canAccessArgumentIndexQuickly(*object, index))
    24472447        byValInfo->arrayProfile->setOutOfBounds();
    2448     return JSValue::encode(jsBoolean(object->hasPropertyGeneric(globalObject, index, PropertySlot::InternalMethodType::GetOwnProperty)));
     2448    return JSValue::encode(jsBoolean(object->hasEnumerableProperty(globalObject, index)));
    24492449}
    24502450   
    … …  
    24672467    if (!CommonSlowPaths::canAccessArgumentIndexQuickly(*object, index))
    24682468        byValInfo->arrayProfile->setOutOfBounds();
    2469     return JSValue::encode(jsBoolean(object->hasPropertyGeneric(globalObject, index, PropertySlot::InternalMethodType::GetOwnProperty)));
     2469    return JSValue::encode(jsBoolean(object->hasEnumerableProperty(globalObject, index)));
    24702470}
    24712471   

  • trunk/Source/JavaScriptCore/jit/JITOperations.h

    r270764 r270874  
    139139using C_JITOperation_B_GJssJss = uintptr_t(JIT_OPERATION_ATTRIBUTES *)(JSGlobalObject*, JSString*, JSString*);
    140140using S_JITOperation_GC = size_t(JIT_OPERATION_ATTRIBUTES *)(JSGlobalObject*, JSCell*);
     141using S_JITOperation_GCZ = size_t(JIT_OPERATION_ATTRIBUTES *)(JSGlobalObject*, JSCell*, int32_t);
    141142using S_JITOperation_GJJ = size_t(JIT_OPERATION_ATTRIBUTES *)(JSGlobalObject*, EncodedJSValue, EncodedJSValue);
    142143using V_JITOperation_GJJJ = void(JIT_OPERATION_ATTRIBUTES *)(JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue);

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r270764 r270874  
    19731973slowPathOp(greater)
    19741974slowPathOp(greatereq)
    1975 slowPathOp(has_generic_property)
    1976 slowPathOp(has_indexed_property)
     1975slowPathOp(has_enumerable_indexed_property)
     1976slowPathOp(has_enumerable_property)
    19771977
    19781978if not JSVALUE64
    1979     slowPathOp(has_structure_property)
     1979    slowPathOp(has_enumerable_structure_property)
    19801980    slowPathOp(has_own_structure_property)
    19811981    slowPathOp(in_structure_property)

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r270764 r270874  
    30423042end
    30433043
    3044 llintOpWithReturn(op_has_structure_property, OpHasStructureProperty, macro (size, get, dispatch, return)
    3045     hasStructurePropertyImpl(size, get, dispatch,  return, _slow_path_has_structure_property)
     3044llintOpWithReturn(op_has_enumerable_structure_property, OpHasEnumerableStructureProperty, macro (size, get, dispatch, return)
     3045    hasStructurePropertyImpl(size, get, dispatch,  return, _slow_path_has_enumerable_structure_property)
    30463046end)
    30473047

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r268656 r270874  
    10411041}
    10421042
    1043 JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_indexed_property)
    1044 {
    1045     BEGIN();
    1046     auto bytecode = pc->as<OpHasIndexedProperty>();
     1043JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_enumerable_indexed_property)
     1044{
     1045    BEGIN();
     1046    auto bytecode = pc->as<OpHasEnumerableIndexedProperty>();
    10471047    auto& metadata = bytecode.metadata(codeBlock);
    10481048    JSObject* base = GET_C(bytecode.m_base).jsValue().toObject(globalObject);
    … …  
    10511051    metadata.m_arrayProfile.observeStructure(base->structure(vm));
    10521052    ASSERT(property.isUInt32AsAnyInt());
    1053     RETURN(jsBoolean(base->hasPropertyGeneric(globalObject, property.asUInt32AsAnyInt(), PropertySlot::InternalMethodType::GetOwnProperty)));
    1054 }
    1055 
    1056 JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_structure_property)
    1057 {
    1058     BEGIN();
    1059     auto bytecode = pc->as<OpHasStructureProperty>();
     1053    RETURN(jsBoolean(base->hasEnumerableProperty(globalObject, property.asUInt32AsAnyInt())));
     1054}
     1055
     1056JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_enumerable_structure_property)
     1057{
     1058    BEGIN();
     1059    auto bytecode = pc->as<OpHasEnumerableStructureProperty>();
    10601060    JSObject* base = GET_C(bytecode.m_base).jsValue().toObject(globalObject);
    10611061    CHECK_EXCEPTION();
    … …  
    10701070    auto propertyName = string->toIdentifier(globalObject);
    10711071    CHECK_EXCEPTION();
    1072     RETURN(jsBoolean(base->hasPropertyGeneric(globalObject, propertyName, PropertySlot::InternalMethodType::GetOwnProperty)));
     1072    RETURN(jsBoolean(base->hasEnumerableProperty(globalObject, propertyName)));
    10731073}
    10741074
    … …  
    11091109}
    11101110
    1111 JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_generic_property)
    1112 {
    1113     BEGIN();
    1114     auto bytecode = pc->as<OpHasGenericProperty>();
     1111JSC_DEFINE_COMMON_SLOW_PATH(slow_path_has_enumerable_property)
     1112{
     1113    BEGIN();
     1114    auto bytecode = pc->as<OpHasEnumerableProperty>();
    11151115    JSObject* base = GET_C(bytecode.m_base).jsValue().toObject(globalObject);
    11161116    CHECK_EXCEPTION();
    … …  
    11201120    auto propertyName = string->toIdentifier(globalObject);
    11211121    CHECK_EXCEPTION();
    1122     RETURN(jsBoolean(base->hasPropertyGeneric(globalObject, propertyName, PropertySlot::InternalMethodType::GetOwnProperty)));
     1122    RETURN(jsBoolean(base->hasEnumerableProperty(globalObject, propertyName)));
    11231123}
    11241124

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h

    r267808 r270874  
    260260JSC_DECLARE_COMMON_SLOW_PATH(slow_path_to_property_key);
    261261JSC_DECLARE_COMMON_SLOW_PATH(slow_path_get_enumerable_length);
    262 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_generic_property);
    263 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_structure_property);
     262JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_enumerable_indexed_property);
     263JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_enumerable_structure_property);
     264JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_enumerable_property);
    264265JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_own_structure_property);
    265266JSC_DECLARE_COMMON_SLOW_PATH(slow_path_in_structure_property);
    266 JSC_DECLARE_COMMON_SLOW_PATH(slow_path_has_indexed_property);
    267267JSC_DECLARE_COMMON_SLOW_PATH(slow_path_get_direct_pname);
    268268JSC_DECLARE_COMMON_SLOW_PATH(slow_path_get_property_enumerator);

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r270298 r270874  
    19881988}
    19891989
    1990 // HasProperty(O, P) from Section 7.3.10 of the spec.
    1991 // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasproperty
     1990// https://tc39.es/ecma262/#sec-hasproperty
    19921991bool JSObject::hasProperty(JSGlobalObject* globalObject, PropertyName propertyName) const
    19931992{
    1994     return hasPropertyGeneric(globalObject, propertyName, PropertySlot::InternalMethodType::HasProperty);
     1993    PropertySlot slot(this, PropertySlot::InternalMethodType::HasProperty);
     1994    return const_cast<JSObject*>(this)->getPropertySlot(globalObject, propertyName, slot);
    19951995}
    19961996
    19971997bool JSObject::hasProperty(JSGlobalObject* globalObject, unsigned propertyName) const
    19981998{
    1999     return hasPropertyGeneric(globalObject, propertyName, PropertySlot::InternalMethodType::HasProperty);
     1999    PropertySlot slot(this, PropertySlot::InternalMethodType::HasProperty);
     2000    return const_cast<JSObject*>(this)->getPropertySlot(globalObject, propertyName, slot);
    20002001}
    20012002
    … …  
    20082009}
    20092010
    2010 bool JSObject::hasPropertyGeneric(JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot::InternalMethodType internalMethodType) const
    2011 {
    2012     PropertySlot slot(this, internalMethodType);
    2013     return const_cast<JSObject*>(this)->getPropertySlot(globalObject, propertyName, slot);
    2014 }
    2015 
    2016 bool JSObject::hasPropertyGeneric(JSGlobalObject* globalObject, unsigned propertyName, PropertySlot::InternalMethodType internalMethodType) const
    2017 {
    2018     PropertySlot slot(this, internalMethodType);
    2019     return const_cast<JSObject*>(this)->getPropertySlot(globalObject, propertyName, slot);
     2011bool JSObject::hasEnumerableProperty(JSGlobalObject* globalObject, PropertyName propertyName) const
     2012{
     2013    VM& vm = globalObject->vm();
     2014    auto scope = DECLARE_THROW_SCOPE(vm);
     2015    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
     2016    bool hasProperty = const_cast<JSObject*>(this)->getPropertySlot(globalObject, propertyName, slot);
     2017    RETURN_IF_EXCEPTION(scope, false);
     2018    return hasProperty && !(slot.attributes() & PropertyAttribute::DontEnum);
     2019}
     2020
     2021bool JSObject::hasEnumerableProperty(JSGlobalObject* globalObject, unsigned propertyName) const
     2022{
     2023    VM& vm = globalObject->vm();
     2024    auto scope = DECLARE_THROW_SCOPE(vm);
     2025    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
     2026    bool hasProperty = const_cast<JSObject*>(this)->getPropertySlot(globalObject, propertyName, slot);
     2027    RETURN_IF_EXCEPTION(scope, false);
     2028    return hasProperty && !(slot.attributes() & PropertyAttribute::DontEnum);
    20202029}
    20212030
    … …  
    23722381}
    23732382
     2383// FIXME: Assert that properties returned by getOwnPropertyNames() are reported enumerable by getOwnPropertySlot().
     2384// https://bugs.webkit.org/show_bug.cgi?id=219926
    23742385void JSObject::getPropertyNames(JSObject* object, JSGlobalObject* globalObject, PropertyNameArray& propertyNames, EnumerationMode mode)
    23752386{

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r270298 r270874  
    656656    JS_EXPORT_PRIVATE bool hasProperty(JSGlobalObject*, unsigned propertyName) const;
    657657    bool hasProperty(JSGlobalObject*, uint64_t propertyName) const;
    658     bool hasPropertyGeneric(JSGlobalObject*, PropertyName, PropertySlot::InternalMethodType) const;
    659     bool hasPropertyGeneric(JSGlobalObject*, unsigned propertyName, PropertySlot::InternalMethodType) const;
     658    bool hasEnumerableProperty(JSGlobalObject*, PropertyName) const;
     659    bool hasEnumerableProperty(JSGlobalObject*, unsigned propertyName) const;
    660660    bool hasOwnProperty(JSGlobalObject*, PropertyName, PropertySlot&) const;
    661661    bool hasOwnProperty(JSGlobalObject*, PropertyName) const;

  • trunk/Source/WebCore/ChangeLog

    r270872 r270874  
     12020-12-15  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        Non-enumerable property fails to shadow inherited enumerable property from for-in
     4        https://bugs.webkit.org/show_bug.cgi?id=38970
     5
     6        Reviewed by Keith Miller.
     7
     8        Report RuntimeArray indices as [[Enumerable]].
     9
     10        Test: platform/mac/fast/dom/wrapper-classes-objc.html
     11
     12        * bridge/runtime_array.cpp:
     13        (JSC::RuntimeArray::getOwnPropertySlot):
     14        (JSC::RuntimeArray::getOwnPropertySlotByIndex):
     15
    1162020-12-15  Jer Noble  <jer.noble@apple.com>
    217

  • trunk/Source/WebCore/bridge/runtime_array.cpp

    r267727 r270874  
    101101    Optional<uint32_t> index = parseIndex(propertyName);
    102102    if (index && index.value() < thisObject->getLength()) {
    103         slot.setValue(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::DontEnum,
     103        slot.setValue(thisObject, static_cast<unsigned>(PropertyAttribute::DontDelete),
    104104            thisObject->getConcreteArray()->valueAt(lexicalGlobalObject, index.value()));
    105105        return true;
    … …  
    113113    RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);
    114114    if (index < thisObject->getLength()) {
    115         slot.setValue(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::DontEnum,
     115        slot.setValue(thisObject, static_cast<unsigned>(PropertyAttribute::DontDelete),
    116116            thisObject->getConcreteArray()->valueAt(lexicalGlobalObject, index));
    117117        return true;
Note: See TracChangeset for help on using the changeset viewer.