Changeset 149527 in webkit


Ignore:
Timestamp:
May 3, 2013, 11:46:45 AM (13 years ago)
Author:
ggaren@apple.com
Message:

Rationalized 'this' value conversion
​https://bugs.webkit.org/show_bug.cgi?id=115542

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This fixes a bunch of Sputnik tests.

The new model is that the callee always performs 'this' value conversion.

My ultimate goal is to break up resolve_with_this into single-result
opcodes. This step avoids having to add a new kind of convert_this for
call sites.

  • API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::call): Perform 'this' value conversion for
our callee, since it may observe 'this'.

  • API/JSCallbackObjectFunctions.h:

(JSC::::call): Ditto.

  • API/JSContextRef.cpp:

(JSGlobalContextCreateInGroup): Use a proxy 'this' object in global scope
even when we're not in the browser. This eliminates some odd cases where
API clients used to be able to get a direct reference to an environment
record. Now, any reference to an environment record unambiguously means
that the VM resolved that record in the scope chain.

(JSContextGetGlobalObject): Removed an incorrect comment. Now that JSC
participates in the proxy 'this' object scheme, the behavior is not
WebCore-only.

  • JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
  • JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:

What are the chances that this will work?

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock): Renamed convert_this to to_this, to match our
other conversion opcodes.

  • bytecode/CodeOrigin.h:

(CodeOrigin):
(InlineCallFrame):
(JSC::CodeOrigin::codeOriginOwner): Use the more precise type for our
executable, so compilation can discover where we're in strict mode.

  • bytecode/Opcode.h:

(JSC::padOpcodeName): Updated for rename.

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator): Always emit to_this when
'this' is in use -- strict mode still needs to convert environment
records to 'undefined'.

  • dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGCapabilities.h:

(JSC::DFG::canCompileOpcode): Updated for renames.

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode): Tightened up this code to consider
strict mode (a new requirement) and to consider the global object (which
was always a requirement).

  • dfg/DFGGraph.h:

(JSC::DFG::Graph::globalThisObjectFor):
(JSC::DFG::Graph::executableFor):

  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:
  • dfg/DFGOperations.h:
  • dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile): Ditto.

  • interpreter/Interpreter.cpp:

(JSC::eval):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):

  • interpreter/Interpreter.h: Don't ASSERT about 'this' -- it's our job

to fix it up if needed.

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

  • jit/JIT.h:

(JIT):

  • jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_to_this):
(JSC::JIT::emitSlow_op_to_this):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_to_this):
(JSC::JIT::emitSlow_op_to_this):

  • jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

  • jit/JITStubs.h: Removed special case code for various kinds of

conversions. The baseline fast path is now only final objects. It hurt
my brain to think through how to keep the other fast paths working, and
our benchmarks do not object.

  • llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

  • llint/LLIntSlowPaths.h:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • profiler/ProfileGenerator.cpp:

(JSC::ProfileGenerator::addParentForConsoleStart):

  • runtime/CallData.cpp:

(JSC::call):

  • runtime/ClassInfo.h:

(MethodTable):
(JSC):

  • runtime/Completion.cpp:

(JSC::evaluate):

  • runtime/DatePrototype.cpp:

(JSC::dateProtoFuncToJSON):

  • runtime/JSActivation.cpp:

(JSC::JSActivation::toThis):

  • runtime/JSActivation.h:

(JSActivation):

  • runtime/JSCJSValue.cpp:

(JSC::JSValue::toThisSlowCase):

  • runtime/JSCJSValue.h:

(JSValue):

  • runtime/JSCJSValueInlines.h:

(JSC::JSValue::toThis):

  • runtime/JSCell.cpp:

(JSC::JSCell::toThis):

  • runtime/JSCell.h:

(JSCell):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::toThis):

  • runtime/JSGlobalObject.h:

(JSGlobalObject):

  • runtime/JSNameScope.cpp:

(JSC::JSNameScope::toThis):

  • runtime/JSNameScope.h:

(JSNameScope):

  • runtime/JSObject.cpp:

(JSC::JSObject::put):
(JSC::JSObject::toThis):

  • runtime/JSObject.h:

(JSObject):

  • runtime/JSScope.cpp:

(JSC::JSScope::resolveWithThis):

  • runtime/JSString.cpp:

(JSC::JSString::toThis):

  • runtime/JSString.h:

(JSString):

  • runtime/PropertySlot.cpp:

(JSC::PropertySlot::functionGetter):

  • runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayEntry::get):
(JSC::SparseArrayEntry::put):

  • runtime/StrictEvalActivation.cpp:

(JSC::StrictEvalActivation::toThis):

  • runtime/StrictEvalActivation.h:

(StrictEvalActivation): Filled out runtime support for converting 'this'
values as needed, according to the strictness of the caller.

Source/WebCore:

Updated to match JSC requirement that the callee performs 'this' value
conversion.

  • WebCore.order:
  • bindings/js/JSErrorHandler.cpp:

(WebCore::JSErrorHandler::handleEvent):

  • bindings/js/JSInjectedScriptHostCustom.cpp:

(WebCore::JSInjectedScriptHost::internalConstructorName):

  • bindings/js/JSMainThreadExecState.h:

(WebCore::JSMainThreadExecState::call):

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

  • bridge/NP_jsobject.cpp:

(_NPN_Invoke):

Source/WebKit/mac:

Updated to match JSC requirement that the callee performs 'this' value
conversion.

  • Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::invoke):
(WebKit::NetscapePluginInstanceProxy::invokeDefault):

Source/WebKit2:

Updated to match JSC requirement that the callee performs 'this' value
conversion.

  • WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::invoke):

LayoutTests:

We pass these tests now:

  • sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt:
  • sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt:
Location:
branches/dfgFourthTier
Files:
81 edited

Legend:

Unmodified
Added
Removed

  • branches/dfgFourthTier/LayoutTests/ChangeLog

    r147604 r149527  
     12013-05-03  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rationalized 'this' value conversion
     4        https://bugs.webkit.org/show_bug.cgi?id=115542
     5
     6        Reviewed by Filip Pizlo.
     7
     8        We pass these tests now:
     9
     10        * sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt:
     11        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt:
     12        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:
     13        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt:
     14        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt:
     15        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:
     16        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt:
     17        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt:
     18        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt:
     19        * sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt:
     20
    1212013-04-03  Filip Pizlo  <fpizlo@apple.com>
    222

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt

    r108729 r149527  
    11S11.1.1_A2
    22
    3 FAIL SputnikError: #1: this.toString() === toString(). Actual: [object Window]
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.10_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.11_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.12_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.13_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.14_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.15_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.6_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.7_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt

    r91344 r149527  
    11S15.5.4.8_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • branches/dfgFourthTier/Source/JavaScriptCore/API/JSCallbackFunction.cpp

    r148697 r149527  
    6868    JSContextRef execRef = toRef(exec);
    6969    JSObjectRef functionRef = toRef(exec->callee());
    70     JSObjectRef thisObjRef = toRef(exec->hostThisValue().toThisObject(exec));
     70    JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(exec->hostThisValue().toThis(exec, NotStrictMode)));
    7171
    7272    int argumentCount = static_cast<int>(exec->argumentCount());

  • branches/dfgFourthTier/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h

    r148697 r149527  
    431431    JSContextRef execRef = toRef(exec);
    432432    JSObjectRef functionRef = toRef(exec->callee());
    433     JSObjectRef thisObjRef = toRef(exec->hostThisValue().toThisObject(exec));
     433    JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(exec->hostThisValue().toThis(exec, NotStrictMode)));
    434434   
    435435    for (JSClassRef jsClass = jsCast<JSCallbackObject<Parent>*>(toJS(functionRef))->classRef(); jsClass; jsClass = jsClass->parentClass) {

  • branches/dfgFourthTier/Source/JavaScriptCore/API/JSContextRef.cpp

    r148697 r149527  
    107107    if (!globalObjectClass) {
    108108        JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
     109        globalObject->setGlobalThis(*vm, JSProxy::create(*vm, JSProxy::createStructure(*vm, globalObject, globalObject->prototype()), globalObject));
    109110        return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
    110111    }
    … …  
    154155    APIEntryShim entryShim(exec);
    155156
    156     // It is necessary to call toThisObject to get the wrapper object when used with WebCore.
    157     return toRef(exec->lexicalGlobalObject()->methodTable()->toThisObject(exec->lexicalGlobalObject(), exec));
     157    return toRef(jsCast<JSObject*>(exec->lexicalGlobalObject()->methodTable()->toThis(exec->lexicalGlobalObject(), exec, NotStrictMode)));
    158158}
    159159

  • branches/dfgFourthTier/Source/JavaScriptCore/API/JSObjectRef.cpp

    r148697 r149527  
    455455        jsThisObject = exec->globalThisValue();
    456456
    457     jsThisObject = jsThisObject->methodTable()->toThisObject(jsThisObject, exec);
    458    
    459457    MarkedArgumentBuffer argList;
    460458    for (size_t i = 0; i < argumentCount; i++)

  • branches/dfgFourthTier/Source/JavaScriptCore/ChangeLog

    r149518 r149527  
     12013-05-03  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rationalized 'this' value conversion
     4        https://bugs.webkit.org/show_bug.cgi?id=115542
     5
     6        Reviewed by Filip Pizlo.
     7
     8        This fixes a bunch of Sputnik tests.
     9
     10        The new model is that the callee always performs 'this' value conversion.
     11
     12        My ultimate goal is to break up resolve_with_this into single-result
     13        opcodes. This step avoids having to add a new kind of convert_this for
     14        call sites.
     15
     16        * API/JSCallbackFunction.cpp:
     17        (JSC::JSCallbackFunction::call): Perform 'this' value conversion for
     18        our callee, since it may observe 'this'.
     19
     20        * API/JSCallbackObjectFunctions.h:
     21        (JSC::::call): Ditto.
     22
     23        * API/JSContextRef.cpp:
     24        (JSGlobalContextCreateInGroup): Use a proxy 'this' object in global scope
     25        even when we're not in the browser. This eliminates some odd cases where
     26        API clients used to be able to get a direct reference to an environment
     27        record. Now, any reference to an environment record unambiguously means
     28        that the VM resolved that record in the scope chain.
     29
     30        (JSContextGetGlobalObject): Removed an incorrect comment. Now that JSC
     31        participates in the proxy 'this' object scheme, the behavior is not
     32        WebCore-only.
     33
     34        * JavaScriptCore.order: Order!
     35
     36        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
     37        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
     38        What are the chances that this will work?
     39
     40        * bytecode/CodeBlock.cpp:
     41        (JSC::CodeBlock::dumpBytecode):
     42        (JSC::CodeBlock::CodeBlock): Renamed convert_this to to_this, to match our
     43        other conversion opcodes.
     44
     45        * bytecode/CodeOrigin.h:
     46        (CodeOrigin):
     47        (InlineCallFrame):
     48        (JSC::CodeOrigin::codeOriginOwner): Use the more precise type for our
     49        executable, so compilation can discover where we're in strict mode.
     50
     51        * bytecode/Opcode.h:
     52        (JSC::padOpcodeName): Updated for rename.
     53
     54        * bytecompiler/BytecodeGenerator.cpp:
     55        (JSC::BytecodeGenerator::BytecodeGenerator): Always emit to_this when
     56        'this' is in use -- strict mode still needs to convert environment
     57        records to 'undefined'.
     58
     59        * dfg/DFGAbstractState.cpp:
     60        (JSC::DFG::AbstractState::executeEffects):
     61        * dfg/DFGByteCodeParser.cpp:
     62        (JSC::DFG::ByteCodeParser::parseBlock):
     63        * dfg/DFGCapabilities.h:
     64        (JSC::DFG::canCompileOpcode): Updated for renames.
     65
     66        * dfg/DFGFixupPhase.cpp:
     67        (JSC::DFG::FixupPhase::fixupNode): Tightened up this code to consider
     68        strict mode (a new requirement) and to consider the global object (which
     69        was always a requirement).
     70
     71        * dfg/DFGGraph.h:
     72        (JSC::DFG::Graph::globalThisObjectFor):
     73        (JSC::DFG::Graph::executableFor):
     74        * dfg/DFGNodeType.h:
     75        * dfg/DFGOperations.cpp:
     76        * dfg/DFGOperations.h:
     77        * dfg/DFGPredictionPropagationPhase.cpp:
     78        (JSC::DFG::PredictionPropagationPhase::propagate):
     79        * dfg/DFGSpeculativeJIT32_64.cpp:
     80        (JSC::DFG::SpeculativeJIT::compile):
     81        * dfg/DFGSpeculativeJIT64.cpp:
     82        (JSC::DFG::SpeculativeJIT::compile): Ditto.
     83
     84        * interpreter/Interpreter.cpp:
     85        (JSC::eval):
     86        (JSC::Interpreter::execute):
     87        (JSC::Interpreter::executeCall):
     88        * interpreter/Interpreter.h: Don't ASSERT about 'this' -- it's our job
     89        to fix it up if needed.
     90
     91        * jit/JIT.cpp:
     92        (JSC::JIT::privateCompileMainPass):
     93        (JSC::JIT::privateCompileSlowCases):
     94        * jit/JIT.h:
     95        (JIT):
     96        * jit/JITOpcodes.cpp:
     97        (JSC::JIT::emit_op_to_this):
     98        (JSC::JIT::emitSlow_op_to_this):
     99        * jit/JITOpcodes32_64.cpp:
     100        (JSC::JIT::emit_op_to_this):
     101        (JSC::JIT::emitSlow_op_to_this):
     102        * jit/JITStubs.cpp:
     103        (JSC::DEFINE_STUB_FUNCTION):
     104        * jit/JITStubs.h: Removed special case code for various kinds of
     105        conversions. The baseline fast path is now only final objects. It hurt
     106        my brain to think through how to keep the other fast paths working, and
     107        our benchmarks do not object.
     108
     109        * llint/LLIntData.cpp:
     110        (JSC::LLInt::Data::performAssertions):
     111        * llint/LLIntSlowPaths.cpp:
     112        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
     113        * llint/LLIntSlowPaths.h:
     114        * llint/LowLevelInterpreter.asm:
     115        * llint/LowLevelInterpreter32_64.asm:
     116        * llint/LowLevelInterpreter64.asm:
     117        * profiler/ProfileGenerator.cpp:
     118        (JSC::ProfileGenerator::addParentForConsoleStart):
     119        * runtime/CallData.cpp:
     120        (JSC::call):
     121        * runtime/ClassInfo.h:
     122        (MethodTable):
     123        (JSC):
     124        * runtime/Completion.cpp:
     125        (JSC::evaluate):
     126        * runtime/DatePrototype.cpp:
     127        (JSC::dateProtoFuncToJSON):
     128        * runtime/JSActivation.cpp:
     129        (JSC::JSActivation::toThis):
     130        * runtime/JSActivation.h:
     131        (JSActivation):
     132        * runtime/JSCJSValue.cpp:
     133        (JSC::JSValue::toThisSlowCase):
     134        * runtime/JSCJSValue.h:
     135        (JSValue):
     136        * runtime/JSCJSValueInlines.h:
     137        (JSC::JSValue::toThis):
     138        * runtime/JSCell.cpp:
     139        (JSC::JSCell::toThis):
     140        * runtime/JSCell.h:
     141        (JSCell):
     142        * runtime/JSGlobalObject.cpp:
     143        (JSC::JSGlobalObject::toThis):
     144        * runtime/JSGlobalObject.h:
     145        (JSGlobalObject):
     146        * runtime/JSNameScope.cpp:
     147        (JSC::JSNameScope::toThis):
     148        * runtime/JSNameScope.h:
     149        (JSNameScope):
     150        * runtime/JSObject.cpp:
     151        (JSC::JSObject::put):
     152        (JSC::JSObject::toThis):
     153        * runtime/JSObject.h:
     154        (JSObject):
     155        * runtime/JSScope.cpp:
     156        (JSC::JSScope::resolveWithThis):
     157        * runtime/JSString.cpp:
     158        (JSC::JSString::toThis):
     159        * runtime/JSString.h:
     160        (JSString):
     161        * runtime/PropertySlot.cpp:
     162        (JSC::PropertySlot::functionGetter):
     163        * runtime/SparseArrayValueMap.cpp:
     164        (JSC::SparseArrayEntry::get):
     165        (JSC::SparseArrayEntry::put):
     166        * runtime/StrictEvalActivation.cpp:
     167        (JSC::StrictEvalActivation::toThis):
     168        * runtime/StrictEvalActivation.h:
     169        (StrictEvalActivation): Filled out runtime support for converting 'this'
     170        values as needed, according to the strictness of the caller.
     171
    11722013-05-02  Filip Pizlo  <fpizlo@apple.com>
    2173

  • branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r149516 r149527  
    718718            break;
    719719        }
    720         case op_convert_this: {
    721             int r0 = (++it)->u.operand;
    722             out.printf("[%4d] convert_this\t %s", location, registerName(r0).data());
     720        case op_to_this: {
     721            int r0 = (++it)->u.operand;
     722            out.printf("[%4d] to_this\t %s", location, registerName(r0).data());
    723723            ++it; // Skip value profile.
    724724            break;
    … …  
    18311831            // fallthrough
    18321832        }
    1833         case op_convert_this:
     1833        case op_to_this:
    18341834        case op_get_by_id:
    18351835        case op_call_put_result:

  • branches/dfgFourthTier/Source/JavaScriptCore/bytecode/CodeOrigin.h

    r149516 r149527  
    4040struct InlineCallFrame;
    4141class ExecState;
    42 class ExecutableBase;
     42class ScriptExecutable;
    4343class JSFunction;
    4444
    … …  
    8383    // If the code origin corresponds to inlined code, gives you the heap object that
    8484    // would have owned the code if it had not been inlined. Otherwise returns 0.
    85     ExecutableBase* codeOriginOwner() const;
     85    ScriptExecutable* codeOriginOwner() const;
    8686   
    8787    unsigned stackOffset() const;
    … …  
    101101struct InlineCallFrame {
    102102    Vector<ValueRecovery> arguments;
    103     WriteBarrier<ExecutableBase> executable;
     103    WriteBarrier<ScriptExecutable> executable;
    104104    WriteBarrier<JSFunction> callee; // This may be null, indicating that this is a closure call and that the JSFunction and JSScope are already on the stack.
    105105    CodeOrigin caller;
    … …  
    150150}
    151151
    152 inline ExecutableBase* CodeOrigin::codeOriginOwner() const
     152inline ScriptExecutable* CodeOrigin::codeOriginOwner() const
    153153{
    154154    if (!inlineCallFrame)

  • branches/dfgFourthTier/Source/JavaScriptCore/bytecode/Opcode.h

    r145000 r149527  
    4747    macro(op_create_this, 4) \
    4848    macro(op_get_callee, 3) \
    49     macro(op_convert_this, 3) \
     49    macro(op_to_this, 3) \
    5050    \
    5151    macro(op_new_object, 4) \

  • branches/dfgFourthTier/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r149248 r149527  
    470470    if (isConstructor()) {
    471471        emitCreateThis(&m_thisRegister);
    472     } else if (!codeBlock->isStrictMode() && (functionBody->usesThis() || codeBlock->usesEval() || m_shouldEmitDebugHooks)) {
    473         UnlinkedValueProfile profile = emitProfiledOpcode(op_convert_this);
     472    } else if (functionBody->usesThis() || codeBlock->usesEval() || m_shouldEmitDebugHooks) {
     473        UnlinkedValueProfile profile = emitProfiledOpcode(op_to_this);
    474474        instructions().append(kill(&m_thisRegister));
    475475        instructions().append(profile);

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

    r149516 r149527  
    11281128        break;
    11291129           
    1130     case ConvertThis: {
     1130    case ToThis: {
    11311131        AbstractValue& source = forNode(node->child1());
    11321132        AbstractValue& destination = forNode(node);

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r149516 r149527  
    20182018            NEXT_OPCODE(op_enter);
    20192019
    2020         case op_convert_this: {
     2020        case op_to_this: {
    20212021            Node* op1 = getThis();
    2022             if (op1->op() != ConvertThis) {
     2022            if (op1->op() != ToThis) {
    20232023                CodeBlockLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
    20242024                ValueProfile* profile =
    … …  
    20342034                    || !profile->m_singletonValue.isCell()
    20352035                    || profile->m_singletonValue.asCell()->classInfo() != &Structure::s_info)
    2036                     setThis(addToGraph(ConvertThis, op1));
     2036                    setThis(addToGraph(ToThis, op1));
    20372037                else {
    20382038                    addToGraph(
    … …  
    20422042                }
    20432043            }
    2044             NEXT_OPCODE(op_convert_this);
     2044            NEXT_OPCODE(op_to_this);
    20452045        }
    20462046

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGCapabilities.h

    r145000 r149527  
    8787    switch (opcodeID) {
    8888    case op_enter:
    89     case op_convert_this:
     89    case op_to_this:
    9090    case op_create_this:
    9191    case op_get_callee:

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r149516 r149527  
    661661        }
    662662           
    663         case ConvertThis: {
     663        case ToThis: {
     664            ECMAMode ecmaMode = m_graph.executableFor(node->codeOrigin)->isStrictMode() ? StrictMode : NotStrictMode;
     665
    664666            if (isOtherSpeculation(node->child1()->prediction())) {
     667                if (ecmaMode == StrictMode) {
     668                    setUseKindAndUnboxIfProfitable<OtherUse>(node->child1());
     669                    node->convertToIdentity();
     670                    break;
     671                }
     672
    665673                m_insertionSet.insertNode(
    666674                    m_indexInBlock, SpecNone, Phantom, node->codeOrigin,
    … …  
    671679            }
    672680           
    673             if (isObjectSpeculation(node->child1()->prediction())) {
     681            if (isFinalObjectSpeculation(node->child1()->prediction())) {
    674682                setUseKindAndUnboxIfProfitable<ObjectUse>(node->child1());
    675683                node->convertToIdentity();

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGGraph.h

    r149516 r149527  
    358358    {
    359359        JSGlobalObject* object = globalObjectFor(codeOrigin);
    360         return object->methodTable()->toThisObject(object, 0);
    361     }
    362    
    363     ExecutableBase* executableFor(InlineCallFrame* inlineCallFrame)
     360        return jsCast<JSObject*>(object->methodTable()->toThis(object, object->globalExec(), NotStrictMode));
     361    }
     362   
     363    ScriptExecutable* executableFor(InlineCallFrame* inlineCallFrame)
    364364    {
    365365        if (!inlineCallFrame)
    … …  
    369369    }
    370370   
    371     ExecutableBase* executableFor(const CodeOrigin& codeOrigin)
     371    ScriptExecutable* executableFor(const CodeOrigin& codeOrigin)
    372372    {
    373373        return executableFor(codeOrigin.inlineCallFrame);

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGNodeType.h

    r148347 r149527  
    5050    \
    5151    /* Nodes for handling functions (both as call and as construct). */\
    52     macro(ConvertThis, NodeResultJS) \
     52    macro(ToThis, NodeResultJS) \
    5353    macro(CreateThis, NodeResultJS) /* Note this is not MustGenerate since we're returning it anyway. */ \
    5454    macro(GetCallee, NodeResultJS) \

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r149516 r149527  
    341341extern "C" {
    342342
    343 EncodedJSValue DFG_OPERATION operationConvertThis(ExecState* exec, EncodedJSValue encodedOp)
    344 {
    345     VM* vm = &exec->vm();
    346     NativeCallFrameTracer tracer(vm, exec);
    347 
    348     return JSValue::encode(JSValue::decode(encodedOp).toThisObject(exec));
     343EncodedJSValue DFG_OPERATION operationToThis(ExecState* exec, EncodedJSValue encodedOp)
     344{
     345    VM* vm = &exec->vm();
     346    NativeCallFrameTracer tracer(vm, exec);
     347
     348    return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
    349349}
    350350

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGOperations.h

    r149516 r149527  
    129129JSCell* DFG_OPERATION operationNewObject(ExecState*, Structure*) WTF_INTERNAL;
    130130JSCell* DFG_OPERATION operationCreateThis(ExecState*, JSObject* constructor, int32_t inlineCapacity) WTF_INTERNAL;
    131 EncodedJSValue DFG_OPERATION operationConvertThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
     131EncodedJSValue DFG_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
    132132EncodedJSValue DFG_OPERATION operationValueAdd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
    133133EncodedJSValue DFG_OPERATION operationValueAddNotNumber(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r146382 r149527  
    370370        }
    371371
    372         case ConvertThis: {
     372        case ToThis: {
    373373            SpeculatedType prediction = node->child1()->prediction();
    374374            if (prediction) {

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r149516 r149527  
    36863686    }
    36873687       
    3688     case ConvertThis: {
     3688    case ToThis: {
    36893689        ASSERT(node->child1().useKind() == UntypedUse);
    36903690
    … …  
    36973697        GPRResult2 resultTag(this);
    36983698        GPRResult resultPayload(this);
    3699         callOperation(operationConvertThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);
     3699        callOperation(operationToThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);
    37003700       
    37013701        cellResult(resultPayload.gpr(), node);

  • branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r149516 r149527  
    35993599    }
    36003600       
    3601     case ConvertThis: {
     3601    case ToThis: {
    36023602        ASSERT(node->child1().useKind() == UntypedUse);
    36033603        JSValueOperand thisValue(this, node->child1());
    … …  
    36073607       
    36083608        GPRResult result(this);
    3609         callOperation(operationConvertThis, result.gpr(), thisValueGPR);
     3609        callOperation(operationToThis, result.gpr(), thisValueGPR);
    36103610       
    36113611        cellResult(result.gpr(), node);

  • branches/dfgFourthTier/Source/JavaScriptCore/interpreter/Interpreter.cpp

    r148697 r149527  
    256256
    257257    JSValue thisValue = callerFrame->thisValue();
    258     ASSERT(isValidThisObject(thisValue, callFrame));
    259258    Interpreter* interpreter = callFrame->vm().interpreter;
    260259    return interpreter->execute(eval, callFrame, thisValue, callerScopeChain);
    … …  
    838837    VM& vm = *scope->vm();
    839838
    840     ASSERT(isValidThisObject(thisObj, callFrame));
    841839    ASSERT(!vm.exception);
    842840    ASSERT(!vm.isCollectorBusy());
    … …  
    1000998{
    1001999    VM& vm = callFrame->vm();
    1002     ASSERT(isValidThisObject(thisValue, callFrame));
    10031000    ASSERT(!callFrame->hadException());
    10041001    ASSERT(!vm.isCollectorBusy());
    … …  
    12491246   
    12501247    ASSERT(scope->vm() == &callFrame->vm());
    1251     ASSERT(isValidThisObject(thisValue, callFrame));
    12521248    ASSERT(!vm.exception);
    12531249    ASSERT(!vm.isCollectorBusy());

  • branches/dfgFourthTier/Source/JavaScriptCore/interpreter/Interpreter.h

    r148697 r149527  
    284284    };
    285285
    286     // This value must not be an object that would require this conversion (WebCore's global object).
    287     inline bool isValidThisObject(JSValue thisValue, ExecState* exec)
    288     {
    289         return !thisValue.isObject() || thisValue.toThisObject(exec) == thisValue;
    290     }
    291 
    292286    JSValue eval(CallFrame*);
    293287    CallFrame* loadVarargs(CallFrame*, JSStack*, JSValue thisValue, JSValue arguments, int firstFreeRegister);

  • branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.cpp

    r149518 r149527  
    266266        DEFINE_OP(op_get_callee)
    267267        DEFINE_OP(op_create_this)
    268         DEFINE_OP(op_convert_this)
     268        DEFINE_OP(op_to_this)
    269269        DEFINE_OP(op_init_lazy_reg)
    270270        DEFINE_OP(op_create_arguments)
    … …  
    480480        DEFINE_SLOWCASE_OP(op_call_varargs)
    481481        DEFINE_SLOWCASE_OP(op_construct)
    482         DEFINE_SLOWCASE_OP(op_convert_this)
     482        DEFINE_SLOWCASE_OP(op_to_this)
    483483        DEFINE_SLOWCASE_OP(op_create_this)
    484484        DEFINE_SLOWCASE_OP(op_div)

  • branches/dfgFourthTier/Source/JavaScriptCore/jit/JIT.h

    r148697 r149527  
    654654        void emit_op_get_callee(Instruction*);
    655655        void emit_op_create_this(Instruction*);
    656         void emit_op_convert_this(Instruction*);
     656        void emit_op_to_this(Instruction*);
    657657        void emit_op_create_arguments(Instruction*);
    658658        void emit_op_debug(Instruction*);
    … …  
    768768        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
    769769        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
    770         void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
     770        void emitSlow_op_to_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
    771771        void emitSlow_op_create_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
    772772        void emitSlow_op_div(Instruction*, Vector<SlowCaseEntry>::iterator&);

  • branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r148697 r149527  
    910910}
    911911
    912 void JIT::emit_op_convert_this(Instruction* currentInstruction)
     912void JIT::emit_op_to_this(Instruction* currentInstruction)
    913913{
    914914    emitGetVirtualRegister(currentInstruction[1].u.operand, regT1);
    915915
    916916    emitJumpSlowCaseIfNotJSCell(regT1);
    917     if (shouldEmitProfiling()) {
    918         loadPtr(Address(regT1, JSCell::structureOffset()), regT0);
     917    loadPtr(Address(regT1, JSCell::structureOffset()), regT0);
     918    if (shouldEmitProfiling())
    919919        emitValueProfilingSite();
    920     }
    921     addSlowCase(branchPtr(Equal, Address(regT1, JSCell::structureOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
     920
     921    addSlowCase(branch8(NotEqual, Address(regT0, Structure::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
    922922}
    923923
    … …  
    975975// Slow cases
    976976
    977 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    978 {
    979     void* globalThis = m_codeBlock->globalObject()->globalThis();
    980 
    981     linkSlowCase(iter);
    982     if (shouldEmitProfiling())
    983         move(TrustedImm64((JSValue::encode(jsUndefined()))), regT0);
    984     Jump isNotUndefined = branch64(NotEqual, regT1, TrustedImm64(JSValue::encode(jsUndefined())));
    985     emitValueProfilingSite();
    986     move(TrustedImm64(JSValue::encode(JSValue(static_cast<JSCell*>(globalThis)))), regT0);
    987     emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
    988     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_convert_this));
    989 
    990     linkSlowCase(iter);
    991     if (shouldEmitProfiling())
    992         move(TrustedImm64(JSValue::encode(m_vm->stringStructure.get())), regT0);
    993     isNotUndefined.link(this);
    994     emitValueProfilingSite();
    995     JITStubCall stubCall(this, cti_op_convert_this);
     977void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
     978{
     979    linkSlowCase(iter);
     980    linkSlowCase(iter);
     981    JITStubCall stubCall(this, cti_op_to_this);
    996982    stubCall.addArgument(regT1);
    997983    stubCall.call(currentInstruction[1].u.operand);

  • branches/dfgFourthTier/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r148697 r149527  
    11971197}
    11981198
    1199 void JIT::emit_op_convert_this(Instruction* currentInstruction)
     1199void JIT::emit_op_to_this(Instruction* currentInstruction)
    12001200{
    12011201    unsigned thisRegister = currentInstruction[1].u.operand;
    … …  
    12041204
    12051205    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag)));
     1206    loadPtr(Address(regT2, JSCell::structureOffset()), regT0);
    12061207    if (shouldEmitProfiling()) {
    1207         loadPtr(Address(regT2, JSCell::structureOffset()), regT0);
    12081208        move(regT3, regT1);
    12091209        emitValueProfilingSite();
    12101210    }
    1211     addSlowCase(branchPtr(Equal, Address(regT2, JSCell::structureOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
    1212 }
    1213 
    1214 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    1215 {
    1216     void* globalThis = m_codeBlock->globalObject()->globalThis();
     1211    addSlowCase(branch8(NotEqual, Address(regT0, Structure::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
     1212}
     1213
     1214void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
     1215{
    12171216    unsigned thisRegister = currentInstruction[1].u.operand;
    12181217
    12191218    linkSlowCase(iter);
    1220     if (shouldEmitProfiling()) {
    1221         move(TrustedImm32(JSValue::UndefinedTag), regT1);
    1222         move(TrustedImm32(0), regT0);
    1223     }
    1224     Jump isNotUndefined = branch32(NotEqual, regT3, TrustedImm32(JSValue::UndefinedTag));
    1225     emitValueProfilingSite();
    1226     move(TrustedImmPtr(globalThis), regT0);
    1227     move(TrustedImm32(JSValue::CellTag), regT1);
    1228     emitStore(thisRegister, regT1, regT0);
    1229     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_convert_this));
    1230 
    1231     linkSlowCase(iter);
    1232     if (shouldEmitProfiling()) {
    1233         move(TrustedImm32(JSValue::CellTag), regT1);
    1234         move(TrustedImmPtr(m_vm->stringStructure.get()), regT0);
    1235     }
    1236     isNotUndefined.link(this);
    1237     emitValueProfilingSite();
    1238     JITStubCall stubCall(this, cti_op_convert_this);
     1219    linkSlowCase(iter);
     1220    JITStubCall stubCall(this, cti_op_to_this);
    12391221    stubCall.addArgument(regT3, regT2);
    12401222    stubCall.call(thisRegister);

  • branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.cpp

    r148804 r149527  
    13271327}
    13281328
    1329 DEFINE_STUB_FUNCTION(EncodedJSValue, op_convert_this)
     1329DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_this)
    13301330{
    13311331    STUB_INIT_STACK_FRAME(stackFrame);
    … …  
    13341334    CallFrame* callFrame = stackFrame.callFrame;
    13351335
    1336     ASSERT(v1.isPrimitive());
    1337 
    1338     JSObject* result = v1.toThisObject(callFrame);
     1336    JSValue result = v1.toThis(callFrame, callFrame->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode);
    13391337    CHECK_FOR_EXCEPTION_AT_END();
    13401338    return JSValue::encode(result);

  • branches/dfgFourthTier/Source/JavaScriptCore/jit/JITStubs.h

    r148697 r149527  
    331331EncodedJSValue JIT_STUB cti_op_check_has_instance(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    332332EncodedJSValue JIT_STUB cti_op_create_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    333 EncodedJSValue JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     333EncodedJSValue JIT_STUB cti_op_to_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    334334EncodedJSValue JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    335335EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION) WTF_INTERNAL;

  • branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntData.cpp

    r148697 r149527  
    105105    ASSERT(StringType == 5);
    106106    ASSERT(ObjectType == 17);
     107    ASSERT(FinalObjectType == 18);
    107108    ASSERT(MasqueradesAsUndefined == 1);
    108109    ASSERT(ImplementsHasInstance == 2);

  • branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r148804 r149527  
    492492}
    493493
    494 LLINT_SLOW_PATH_DECL(slow_path_convert_this)
     494LLINT_SLOW_PATH_DECL(slow_path_to_this)
    495495{
    496496    LLINT_BEGIN();
    497497    JSValue v1 = LLINT_OP(1).jsValue();
    498     ASSERT(v1.isPrimitive());
    499498#if ENABLE(VALUE_PROFILER)
    500     pc[OPCODE_LENGTH(op_convert_this) - 1].u.profile->m_buckets[0] =
     499    pc[OPCODE_LENGTH(op_to_this) - 1].u.profile->m_buckets[0] =
    501500        JSValue::encode(v1.structureOrUndefined());
    502501#endif
    503     LLINT_RETURN(v1.toThisObject(exec));
     502    LLINT_RETURN(v1.toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
    504503}
    505504

  • branches/dfgFourthTier/Source/JavaScriptCore/llint/LLIntSlowPaths.h

    r133688 r149527  
    119119LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_arguments);
    120120LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_this);
    121 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_convert_this);
     121LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to_this);
    122122LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_object);
    123123LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array);

  • branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r148697 r149527  
    101101const StringType = 5
    102102const ObjectType = 17
     103const FinalObjectType = 18
    103104
    104105# Type flags constants.

  • branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r148697 r149527  
    387387
    388388
    389 _llint_op_convert_this:
    390     traceExecution()
    391     loadi 4[PC], t0
    392     bineq TagOffset[cfr, t0, 8], CellTag, .opConvertThisSlow
     389_llint_op_to_this:
     390    traceExecution()
     391    loadi 4[PC], t0
     392    bineq TagOffset[cfr, t0, 8], CellTag, .opToThisSlow
    393393    loadi PayloadOffset[cfr, t0, 8], t0
    394394    loadp JSCell::m_structure[t0], t0
    395     bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
     395    bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], FinalObjectType, .opToThisSlow
    396396    loadi 8[PC], t1
    397397    valueProfile(CellTag, t0, t1)
    398398    dispatch(3)
    399399
    400 .opConvertThisSlow:
    401     callSlowPath(_llint_slow_path_convert_this)
     400.opToThisSlow:
     401    callSlowPath(_llint_slow_path_to_this)
    402402    dispatch(3)
    403403

  • branches/dfgFourthTier/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r148697 r149527  
    267267
    268268
    269 _llint_op_convert_this:
     269_llint_op_to_this:
    270270    traceExecution()
    271271    loadisFromInstruction(1, t0)
    272272    loadq [cfr, t0, 8], t0
    273     btqnz t0, tagMask, .opConvertThisSlow
     273    btqnz t0, tagMask, .opToThisSlow
    274274    loadp JSCell::m_structure[t0], t0
    275     bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
     275    bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], FinalObjectType, .opToThisSlow
    276276    loadpFromInstruction(2, t1)
    277277    valueProfile(t0, t1)
    278278    dispatch(3)
    279279
    280 .opConvertThisSlow:
    281     callSlowPath(_llint_slow_path_convert_this)
     280.opToThisSlow:
     281    callSlowPath(_llint_slow_path_to_this)
    282282    dispatch(3)
    283283

  • branches/dfgFourthTier/Source/JavaScriptCore/profiler/ProfileGenerator.cpp

    r139541 r149527  
    6565
    6666    exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
    67     m_currentNode = ProfileNode::create(exec, LegacyProfiler::createCallIdentifier(exec, function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     67    m_currentNode = ProfileNode::create(exec, LegacyProfiler::createCallIdentifier(exec, function, sourceURL, lineNumber), m_head.get(), m_head.get());
    6868    m_head->insertNode(m_currentNode.get());
    6969}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/CallData.cpp

    r139541 r149527  
    3737{
    3838    ASSERT(callType == CallTypeJS || callType == CallTypeHost);
    39     ASSERT(isValidThisObject(thisValue, exec));
    4039    return exec->interpreter()->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args);
    4140}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/ClassInfo.h

    r134898 r149527  
    6767    GetOwnPropertySlotByIndexFunctionPtr getOwnPropertySlotByIndex;
    6868
    69     typedef JSObject* (*ToThisObjectFunctionPtr)(JSCell*, ExecState*);
    70     ToThisObjectFunctionPtr toThisObject;
     69    typedef JSValue (*ToThisFunctionPtr)(JSCell*, ExecState*, ECMAMode);
     70    ToThisFunctionPtr toThis;
    7171
    7272    typedef JSValue (*DefaultValueFunctionPtr)(const JSObject*, ExecState*, PreferredPrimitiveType);
    … …  
    129129        &ClassName::getOwnPropertySlot, \
    130130        &ClassName::getOwnPropertySlotByIndex, \
    131         &ClassName::toThisObject, \
     131        &ClassName::toThis, \
    132132        &ClassName::defaultValue, \
    133133        &ClassName::getOwnPropertyNames, \

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/Completion.cpp

    r148697 r149527  
    7272    if (!thisValue || thisValue.isUndefinedOrNull())
    7373        thisValue = exec->dynamicGlobalObject();
    74     JSObject* thisObj = thisValue.toThisObject(exec);
     74    JSObject* thisObj = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
    7575    JSValue result = exec->interpreter()->execute(program, exec, thisObj);
    7676

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/DatePrototype.cpp

    r148697 r149527  
    11081108{
    11091109    JSValue thisValue = exec->hostThisValue();
    1110     JSObject* object = thisValue.toThisObject(exec);
     1110    JSObject* object = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
    11111111    if (exec->hadException())
    11121112        return JSValue::encode(jsNull());

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSActivation.cpp

    r149248 r149527  
    237237}
    238238
    239 JSObject* JSActivation::toThisObject(JSCell*, ExecState* exec)
    240 {
     239JSValue JSActivation::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
     240{
     241    if (ecmaMode == StrictMode)
     242        return jsUndefined();
    241243    return exec->globalThisValue();
    242244}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSActivation.h

    r148697 r149527  
    7474        static bool deleteProperty(JSCell*, ExecState*, PropertyName);
    7575
    76         static JSObject* toThisObject(JSCell*, ExecState*);
     76        static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    7777
    7878        void tearOff(VM&);

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSCJSValue.cpp

    r148697 r149527  
    8181}
    8282
    83 JSObject* JSValue::toThisObjectSlowCase(ExecState* exec) const
     83JSValue JSValue::toThisSlowCase(ExecState* exec, ECMAMode ecmaMode) const
    8484{
    8585    ASSERT(!isCell());
     86
     87    if (ecmaMode == StrictMode)
     88        return *this;
    8689
    8790    if (isInt32() || isDouble())

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSCJSValue.h

    r148697 r149527  
    7373
    7474enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
    75 
     75enum ECMAMode { StrictMode, NotStrictMode };
    7676
    7777typedef int64_t EncodedJSValue;
    … …  
    246246    void putByIndex(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
    247247
    248     JSObject* toThisObject(ExecState*) const;
     248    JSValue toThis(ExecState*, ECMAMode) const;
    249249
    250250    static bool equal(ExecState*, JSValue v1, JSValue v2);
    … …  
    276276    JS_EXPORT_PRIVATE WTF::String toWTFStringSlowCase(ExecState*) const;
    277277    JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
    278     JS_EXPORT_PRIVATE JSObject* toThisObjectSlowCase(ExecState*) const;
     278    JS_EXPORT_PRIVATE JSValue toThisSlowCase(ExecState*, ECMAMode) const;
    279279
    280280#if USE(JSVALUE32_64)

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSCJSValueInlines.h

    r143232 r149527  
    615615}
    616616
    617 inline JSObject* JSValue::toThisObject(ExecState* exec) const
    618 {
    619     return isCell() ? asCell()->methodTable()->toThisObject(asCell(), exec) : toThisObjectSlowCase(exec);
     617inline JSValue JSValue::toThis(ExecState* exec, ECMAMode ecmaMode) const
     618{
     619    return isCell() ? asCell()->methodTable()->toThis(asCell(), exec, ecmaMode) : toThisSlowCase(exec, ecmaMode);
    620620}
    621621

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSCell.cpp

    r145945 r149527  
    134134}
    135135
    136 JSObject* JSCell::toThisObject(JSCell* cell, ExecState* exec)
    137 {
     136JSValue JSCell::toThis(JSCell* cell, ExecState* exec, ECMAMode ecmaMode)
     137{
     138    if (ecmaMode == StrictMode)
     139        return cell;
    138140    return cell->toObject(exec, exec->lexicalGlobalObject());
    139141}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSCell.h

    r148697 r149527  
    113113    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
    114114
    115     static JSObject* toThisObject(JSCell*, ExecState*);
     115    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    116116
    117117    void zap() { *reinterpret_cast<uintptr_t**>(this) = 0; }

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r148697 r149527  
    536536}
    537537
    538 JSObject* JSGlobalObject::toThisObject(JSCell* cell, ExecState*)
    539 {
    540     return jsCast<JSGlobalObject*>(cell)->globalThis();
     538JSValue JSGlobalObject::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
     539{
     540    if (ecmaMode == StrictMode)
     541        return jsUndefined();
     542    return exec->globalThisValue();
    541543}
    542544

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r148697 r149527  
    378378    VM& vm() const { return *Heap::heap(this)->vm(); }
    379379    JSObject* globalThis() const;
     380    JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
    380381
    381382    static Structure* createStructure(VM& vm, JSValue prototype)
    … …  
    420421    JS_EXPORT_PRIVATE void addStaticGlobals(GlobalPropertyInfo*, int count);
    421422
    422     JS_EXPORT_PRIVATE static JSC::JSObject* toThisObject(JSC::JSCell*, JSC::ExecState*);
    423 
    424     JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
     423    JS_EXPORT_PRIVATE static JSC::JSValue toThis(JSC::JSCell*, JSC::ExecState*, ECMAMode);
    425424
    426425private:

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSNameScope.cpp

    r140594 r149527  
    4545}
    4646
    47 JSObject* JSNameScope::toThisObject(JSCell*, ExecState* exec)
     47JSValue JSNameScope::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
    4848{
     49    if (ecmaMode == StrictMode)
     50        return jsUndefined();
    4951    return exec->globalThisValue();
    5052}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSNameScope.h

    r148697 r149527  
    5353    static void visitChildren(JSCell*, SlotVisitor&);
    5454    bool isDynamicScope(bool& requiresDynamicChecks) const;
    55     static JSObject* toThisObject(JSCell*, ExecState*);
     55    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    5656    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
    5757    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSObject.cpp

    r148697 r149527  
    397397                args.append(value);
    398398
    399                 // If this is WebCore's global object then we need to substitute the shell.
    400                 call(exec, setterFunc, callType, callData, thisObject->methodTable()->toThisObject(thisObject, exec), args);
     399                call(exec, setterFunc, callType, callData, thisObject, args);
    401400                return;
    402401            } else
    … …  
    15511550}
    15521551
    1553 JSObject* JSObject::toThisObject(JSCell* cell, ExecState*)
     1552JSValue JSObject::toThis(JSCell* cell, ExecState*, ECMAMode)
    15541553{
    15551554    return jsCast<JSObject*>(cell);

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSObject.h

    r148697 r149527  
    489489    // NOTE: JSObject and its subclasses must be able to gracefully handle ExecState* = 0,
    490490    // because this call may come from inside the compiler.
    491     JS_EXPORT_PRIVATE static JSObject* toThisObject(JSCell*, ExecState*);
     491    JS_EXPORT_PRIVATE static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    492492
    493493    bool getPropertySpecificValue(ExecState*, PropertyName, JSCell*& specificFunction) const;

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSScope.cpp

    r148804 r149527  
    537537            return JSValue();
    538538        ASSERT(value);
    539         *base = propertyBase->structure()->typeInfo().isEnvironmentRecord() ? jsUndefined() : JSValue(propertyBase);
     539        *base = JSValue(propertyBase);
    540540        return value;
    541541    }

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSString.cpp

    r148697 r149527  
    272272}
    273273
    274 JSObject* JSString::toThisObject(JSCell* cell, ExecState* exec)
    275 {
     274JSValue JSString::toThis(JSCell* cell, ExecState* exec, ECMAMode ecmaMode)
     275{
     276    if (ecmaMode == StrictMode)
     277        return cell;
    276278    return StringObject::create(exec, exec->lexicalGlobalObject(), jsCast<JSString*>(cell));
    277279}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/JSString.h

    r148697 r149527  
    201201        friend class LLIntOffsetsExtractor;
    202202       
    203         static JSObject* toThisObject(JSCell*, ExecState*);
     203        static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    204204
    205205        // Actually getPropertySlot, not getOwnPropertySlot (see JSCell).

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/PropertySlot.cpp

    r139541 r149527  
    3636    CallData callData;
    3737    CallType callType = m_data.getterFunc->methodTable()->getCallData(m_data.getterFunc, callData);
    38     return call(exec, m_data.getterFunc, callType, callData, m_thisValue.isObject() ? m_thisValue.toThisObject(exec) : m_thisValue, exec->emptyList());
     38    return call(exec, m_data.getterFunc, callType, callData, m_thisValue, exec->emptyList());
    3939}
    4040

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp

    r148697 r149527  
    161161    CallData callData;
    162162    CallType callType = getter->methodTable()->getCallData(getter, callData);
    163     return call(exec, getter, callType, callData, array->methodTable()->toThisObject(array, exec), exec->emptyList());
     163    return call(exec, getter, callType, callData, array, exec->emptyList());
    164164}
    165165
    … …  
    191191    MarkedArgumentBuffer args;
    192192    args.append(value);
    193     if (thisValue.isObject())
    194         thisValue = asObject(thisValue)->methodTable()->toThisObject(asObject(thisValue), exec);
    195193    call(exec, setter, callType, callData, thisValue, args);
    196194}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp

    r148697 r149527  
    5050}
    5151
    52 JSObject* StrictEvalActivation::toThisObject(JSCell*, ExecState* exec)
     52JSValue StrictEvalActivation::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
    5353{
     54    if (ecmaMode == StrictMode)
     55        return jsUndefined();
    5456    return exec->globalThisValue();
    5557}

  • branches/dfgFourthTier/Source/JavaScriptCore/runtime/StrictEvalActivation.h

    r148697 r149527  
    4343
    4444    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
    45     static JSObject* toThisObject(JSCell*, ExecState*);
     45    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    4646
    4747    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

  • branches/dfgFourthTier/Source/WebCore/ChangeLog

    r149351 r149527  
     12013-05-03  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rationalized 'this' value conversion
     4        https://bugs.webkit.org/show_bug.cgi?id=115542
     5
     6        Reviewed by Filip Pizlo.
     7
     8        Updated to match JSC requirement that the callee performs 'this' value
     9        conversion.
     10
     11        * WebCore.order:
     12        * bindings/js/JSErrorHandler.cpp:
     13        (WebCore::JSErrorHandler::handleEvent):
     14        * bindings/js/JSInjectedScriptHostCustom.cpp:
     15        (WebCore::JSInjectedScriptHost::internalConstructorName):
     16        * bindings/js/JSMainThreadExecState.h:
     17        (WebCore::JSMainThreadExecState::call):
     18        * bindings/scripts/CodeGeneratorJS.pm:
     19        (GenerateImplementation):
     20        * bridge/NP_jsobject.cpp:
     21        (_NPN_Invoke):
     22
    1232013-04-29  Filip Pizlo  <fpizlo@apple.com>
    224

  • branches/dfgFourthTier/Source/WebCore/WebCore.order

    r148697 r149527  
    28032803__ZN7WebCore13ScriptElement13executeScriptERKNS_16ScriptSourceCodeE
    28042804__ZNK7WebCore21ContentSecurityPolicy17allowInlineScriptEv
    2805 __ZNK7WebCore15JSDOMWindowBase12toThisObjectEPN3JSC9ExecStateE
    28062805__ZN7WebCore16JSDOMWindowShell18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
    28072806__ZN7WebCore16JSDOMWindowShell17putWithAttributesEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueEj

  • branches/dfgFourthTier/Source/WebCore/bindings/js/JSErrorHandler.cpp

    r148697 r149527  
    9393        DynamicGlobalObjectScope globalObjectScope(vm, vm.dynamicGlobalObject ? vm.dynamicGlobalObject : globalObject);
    9494
    95         JSValue thisValue = globalObject->methodTable()->toThisObject(globalObject, exec);
    96 
    9795        vm.timeoutChecker.start();
    9896        JSValue returnValue = scriptExecutionContext->isDocument()
    99             ? JSMainThreadExecState::call(exec, jsFunction, callType, callData, thisValue, args)
    100             : JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     97            ? JSMainThreadExecState::call(exec, jsFunction, callType, callData, globalObject, args)
     98            : JSC::call(exec, jsFunction, callType, callData, globalObject, args);
    10199        vm.timeoutChecker.stop();
    102100

  • branches/dfgFourthTier/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp

    r148697 r149527  
    113113        return jsUndefined();
    114114
    115     JSObject* thisObject = exec->argument(0).toThisObject(exec);
     115    JSObject* thisObject = jsCast<JSObject*>(exec->argument(0).toThis(exec, NotStrictMode));
    116116    String result = thisObject->methodTable()->className(thisObject);
    117117    return jsStringWithCache(exec, result);

  • branches/dfgFourthTier/Source/WebCore/bindings/js/JSMainThreadExecState.h

    r130021 r149527  
    5151    {
    5252        JSMainThreadExecState currentState(exec);
    53         // Ensure DOM global object is unwrapped to the shell.
    54         if (thisValue.isObject())
    55             thisValue = thisValue.toThisObject(exec);
    5653        return JSC::call(exec, functionObject, callType, callData, thisValue, args);
    5754    };

  • branches/dfgFourthTier/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r148697 r149527  
    23112311            } else {
    23122312                if ($interfaceName eq "DOMWindow") {
    2313                     push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThisObject(exec));\n");
     2313                    push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThis(exec, NotStrictMode));\n");
    23142314                    push(@implContent, "    if (!castedThis)\n");
    23152315                    push(@implContent, "        return throwVMTypeError(exec);\n");
    23162316                } elsif ($interface->extendedAttributes->{"IsWorkerContext"}) {
    2317                     push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThisObject(exec));\n");
     2317                    push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThis(exec, NotStrictMode));\n");
    23182318                    push(@implContent, "    if (!castedThis)\n");
    23192319                    push(@implContent, "        return throwVMTypeError(exec);\n");

  • branches/dfgFourthTier/Source/WebCore/bridge/NP_jsobject.cpp

    r130612 r149527  
    235235        MarkedArgumentBuffer argList;
    236236        getListFromVariantArgs(exec, args, argCount, rootObject, argList);
    237         JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp->methodTable()->toThisObject(obj->imp, exec), argList);
     237        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
    238238
    239239        // Convert and return the result of the function call.

  • branches/dfgFourthTier/Source/WebKit/mac/ChangeLog

    r148697 r149527  
     12013-05-03  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rationalized 'this' value conversion
     4        https://bugs.webkit.org/show_bug.cgi?id=115542
     5
     6        Reviewed by Filip Pizlo.
     7
     8        Updated to match JSC requirement that the callee performs 'this' value
     9        conversion.
     10
     11        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
     12        (WebKit::NetscapePluginInstanceProxy::invoke):
     13        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
     14
    1152013-04-18  Geoffrey Garen  <ggaren@apple.com>
    216

  • branches/dfgFourthTier/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm

    r148697 r149527  
    914914    demarshalValues(exec, argumentsData, argumentsLength, argList);
    915915
    916     JSValue value = call(exec, function, callType, callData, object->methodTable()->toThisObject(object, exec), argList);
     916    JSValue value = call(exec, function, callType, callData, object, argList);
    917917       
    918918    marshalValue(exec, value, resultData, resultLength);
    … …  
    946946    demarshalValues(exec, argumentsData, argumentsLength, argList);
    947947
    948     JSValue value = call(exec, object, callType, callData, object->methodTable()->toThisObject(object, exec), argList);
     948    JSValue value = call(exec, object, callType, callData, object, argList);
    949949   
    950950    marshalValue(exec, value, resultData, resultLength);

  • branches/dfgFourthTier/Source/WebKit2/ChangeLog

    r148697 r149527  
     12013-05-03  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rationalized 'this' value conversion
     4        https://bugs.webkit.org/show_bug.cgi?id=115542
     5
     6        Reviewed by Filip Pizlo.
     7
     8        Updated to match JSC requirement that the callee performs 'this' value
     9        conversion.
     10
     11        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
     12        (WebKit::NPJSObject::invoke):
     13
    1142013-04-18  Geoffrey Garen  <ggaren@apple.com>
    215

  • branches/dfgFourthTier/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp

    r148697 r149527  
    294294
    295295    exec->vm().timeoutChecker.start();
    296     JSValue value = JSC::call(exec, function, callType, callData, m_jsObject->methodTable()->toThisObject(m_jsObject.get(), exec), argumentList);
     296    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject.get(), argumentList);
    297297    exec->vm().timeoutChecker.stop();
    298298
Note: See TracChangeset for help on using the changeset viewer.