Changeset 153145 in webkit


Ignore:
Timestamp:
Jul 24, 2013 8:59:41 PM (11 years ago)
Author:
oliver@apple.com
Message:

fourthTier: Rationalized 'this' conversion, includes subsequent FTL branch fixes

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

Rationalized 'this' value conversion
​https://bugs.webkit.org/show_bug.cgi?id=115542

This fixes a bunch of Sputnik tests, and some bad pointer access.

The new model is that the callee always performs 'this' value conversion.

My ultimate goal is to break up resolve_with_this into single-result
opcodes. This step avoids having to add a special form of convert_this
that distinguishes callers vs callees.

Only the callee knows whether it uses 'this' and/or whether 'this'
conversion should use StrictMode, so it's most natural to perform
convert_this in the callee.

  • API/JSCallbackFunction.cpp: (JSC::JSCallbackFunction::call): Perform 'this' value conversion for our callee, since it may observe 'this'.
  • API/JSCallbackObjectFunctions.h: (JSC::::call): Ditto.
  • API/JSContextRef.cpp: (JSGlobalContextCreateInGroup): Use a proxy 'this' object in global scope even when we're not in the browser. This eliminates some odd cases where API clients used to be able to get a direct reference to an environment record. Now, any reference to an environment record unambiguously means that the VM resolved that record in the scope chain.

(JSContextGetGlobalObject): Removed an incorrect comment. Now that JSC
participates in the proxy 'this' object scheme, the behavior is not
WebCore-only.

  • API/JSObjectRef.cpp: (JSObjectSetPrototype): (JSObjectCallAsFunction): Don't perform 'this' value conversion in the caller; the callee will do it if needed.
  • JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
  • JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: What are the chances that this will work?
  • bytecode/CodeBlock.cpp: (JSC::CodeBlock::dumpBytecode): (JSC::CodeBlock::CodeBlock): Renamed convert_this to to_this, to match our other conversion opcodes.
  • bytecode/CodeOrigin.h: (CodeOrigin): (InlineCallFrame): (JSC::CodeOrigin::codeOriginOwner): Use the more precise type for our executable, so compilation can discover where we're in strict mode.
  • bytecode/Opcode.h: (JSC::padOpcodeName): Updated for rename.
  • bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::BytecodeGenerator): Always emit to_this when 'this' is in use -- strict mode still needs to convert environment records to 'undefined'.
  • dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::executeEffects):
  • dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
  • dfg/DFGCapabilities.h: (JSC::DFG::canCompileOpcode): Updated for renames.
  • dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): Tightened up this code to consider strict mode (a new requirement) and to consider the global object (which was always a requirement).
  • dfg/DFGGraph.h: (JSC::DFG::Graph::globalThisObjectFor): (JSC::DFG::Graph::executableFor):
  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:
  • dfg/DFGOperations.h:
  • dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate):
  • dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile):
  • dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): Ditto.
  • interpreter/Interpreter.cpp: (JSC::eval): (JSC::Interpreter::execute): (JSC::Interpreter::executeCall):
  • interpreter/Interpreter.h: Don't ASSERT about 'this' -- it's our job to fix it up if needed.
  • jit/JIT.cpp: (JSC::JIT::privateCompileMainPass): (JSC::JIT::privateCompileSlowCases):
  • jit/JIT.h: (JIT):
  • jit/JITOpcodes.cpp: (JSC::JIT::emit_op_to_this): (JSC::JIT::emitSlow_op_to_this):
  • jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_to_this): (JSC::JIT::emitSlow_op_to_this):
  • jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
  • jit/JITStubs.h: Removed special-case code for various kinds of conversions. The baseline fast path is now final objects only. It hurt my brain to think through how to keep the other fast paths working, and our benchmarks do not object.
  • llint/LLIntData.cpp: (JSC::LLInt::Data::performAssertions):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::LLINT_SLOW_PATH_DECL):
  • llint/LLIntSlowPaths.h: (LLInt):
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm: Updated for renames. Removed some special case code, as in the JIT above.
  • profiler/ProfileGenerator.cpp: (JSC::ProfileGenerator::addParentForConsoleStart):
  • runtime/CallData.cpp: (JSC::call):
  • runtime/ClassInfo.h: (MethodTable):
  • runtime/Completion.cpp: (JSC::evaluate):
  • runtime/DatePrototype.cpp: (JSC::dateProtoFuncToJSON): The callee performs 'this' conversion, not the caller.
  • runtime/GetterSetter.cpp: (JSC::callGetter): (JSC::callSetter):
  • runtime/GetterSetter.h: Added helper functions for invoking getters and setters from C++ code, since this was duplicated in a bunch of places.
  • runtime/JSActivation.cpp: (JSC::JSActivation::toThis):
  • runtime/JSActivation.h: (JSActivation):
  • runtime/JSCJSValue.cpp: (JSC::JSValue::toThisSlowCase): (JSC::JSValue::putToPrimitive):
  • runtime/JSCJSValue.h: (JSValue):
  • runtime/JSCJSValueInlines.h: (JSC::JSValue::toThis):
  • runtime/JSCell.cpp: (JSC::JSCell::toThis):
  • runtime/JSCell.h: (JSCell):
  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::toThis):
  • runtime/JSGlobalObject.h: (JSGlobalObject): Filled out runtime support for converting 'this' values as needed, according to the appropriate strictness, using helper functions where getter/setter code was duplicated.
  • runtime/JSGlobalObjectFunctions.cpp: (JSC::globalFuncProtoGetter): (JSC::globalFuncProtoSetter): Perform 'this' value conversion, since we observe 'this'.
  • runtime/JSNameScope.cpp: (JSC::JSNameScope::toThis):
  • runtime/JSNameScope.h: (JSNameScope): Same as JSActivation.
  • runtime/JSObject.cpp: (JSC::JSObject::put): (JSC::JSObject::setPrototypeWithCycleCheck): Bug fix. Don't peform 'this' value conversion in this helper function. The proto setter does this for us, since it's the function that logically observes 'this' -- and we can ASSERT so. Also, the previous code used "globalExec()->thisValue()", which is a read past the beginning of a buffer! I don't think this ever worked on purpose.

(JSC::JSObject::toThis):
(JSC::JSObject::fillGetterPropertySlot):

  • runtime/JSObject.h: (JSC::JSObject::inlineGetOwnPropertySlot):
  • runtime/JSScope.cpp: (JSC::JSScope::resolveWithThis):
  • runtime/JSString.cpp: (JSC::JSString::toThis):
  • runtime/JSString.h: (JSString):
  • runtime/PropertySlot.cpp: (JSC::PropertySlot::functionGetter):
  • runtime/PropertySlot.h: (JSC): (JSC::PropertySlot::setGetterSlot): (JSC::PropertySlot::setCacheableGetterSlot):
  • runtime/SparseArrayValueMap.cpp: (JSC::SparseArrayEntry::get): (JSC::SparseArrayEntry::put):
  • runtime/StrictEvalActivation.cpp: (JSC::StrictEvalActivation::toThis):
  • runtime/StrictEvalActivation.h: (StrictEvalActivation): Ditto.

Source/WebCore:

Rationalized 'this' value conversion
​https://bugs.webkit.org/show_bug.cgi?id=115542

Source/WebKit/mac:

Rationalized 'this' value conversion
​https://bugs.webkit.org/show_bug.cgi?id=115542

Source/WebKit2:

Rationalized 'this' value conversion
​https://bugs.webkit.org/show_bug.cgi?id=115542

LayoutTests:

Rationalized 'this' value conversion
​https://bugs.webkit.org/show_bug.cgi?id=115542

Location:
trunk
Files:
88 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r153121 r153145  
     12013-05-05  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rolled back in r149527 with crash fixed.
     4
     5        Reviewed by Oliver Hunt.
     6
     7            Rationalized 'this' value conversion
     8            https://bugs.webkit.org/show_bug.cgi?id=115542
     9
    1102013-04-03  Filip Pizlo  <fpizlo@apple.com>
    211

  • trunk/LayoutTests/fast/js/Object-defineProperty-expected.txt

    r110521 r153145  
    100100PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {set:function(x){this.result = x;}}); o.foo = 42; o.result; is 42
    101101PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:function(){return 42;}, set:undefined}); o.foo is 42
    102 PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:function(){return 42;}, set:undefined}); o.foo = 42; o.result; threw exception TypeError: setting a property that has only a getter.
     102PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:function(){return 42;}, set:undefined}); o.foo = 42; o.result; threw exception TypeError: Attempted to assign to readonly property..
    103103PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:function(){return 42;}}); o.foo is 42
    104 PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:function(){return 42;}}); o.foo = 42; o.result; threw exception TypeError: setting a property that has only a getter.
     104PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:function(){return 42;}}); o.foo = 42; o.result; threw exception TypeError: Attempted to assign to readonly property..
    105105PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:undefined, set:undefined}); o.foo is undefined
    106 PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:undefined, set:undefined}); o.foo = 42; o.result; threw exception TypeError: setting a property that has only a getter.
     106PASS 'use strict'; var o = Object.defineProperty({}, 'foo', {get:undefined, set:undefined}); o.foo = 42; o.result; threw exception TypeError: Attempted to assign to readonly property..
    107107PASS 'use strict'; var o = Object.defineProperty(Object.defineProperty({foo:1}, 'foo', {get:function(){return 42;}, set:function(x){this.result = x;}}), 'foo', {get:function(){return 13;}}); o.foo is 13
    108108PASS 'use strict'; var o = Object.defineProperty(Object.defineProperty({foo:1}, 'foo', {get:function(){return 42;}, set:function(x){this.result = x;}}), 'foo', {get:function(){return 13;}}); o.foo = 42; o.result; is 42
    … …  
    112112PASS 'use strict'; var o = Object.defineProperty(Object.defineProperty({foo:1}, 'foo', {get:function(){return 42;}, set:function(x){this.result = x;}}), 'foo', {set:function(){this.result = 13;}}); o.foo = 42; o.result; is 13
    113113PASS 'use strict'; var o = Object.defineProperty(Object.defineProperty({foo:1}, 'foo', {get:function(){return 42;}, set:function(x){this.result = x;}}), 'foo', {set:undefined}); o.foo is 42
    114 PASS 'use strict'; var o = Object.defineProperty(Object.defineProperty({foo:1}, 'foo', {get:function(){return 42;}, set:function(x){this.result = x;}}), 'foo', {set:undefined}); o.foo = 42; o.result; threw exception TypeError: setting a property that has only a getter.
     114PASS 'use strict'; var o = Object.defineProperty(Object.defineProperty({foo:1}, 'foo', {get:function(){return 42;}, set:function(x){this.result = x;}}), 'foo', {set:undefined}); o.foo = 42; o.result; threw exception TypeError: Attempted to assign to readonly property..
    115115PASS 0 in Object.prototype is true
    116116PASS '0' in Object.prototype is true

  • trunk/LayoutTests/sputnik/Conformance/11_Expressions/11.1_Primary_Expressions/11.1.1_The_this_Keyword/S11.1.1_A2-expected.txt

    r108729 r153145  
    11S11.1.1_A2
    22
    3 FAIL SputnikError: #1: this.toString() === toString(). Actual: [object Window]
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.10_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.11_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.12_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.13_String.prototype.slice/S15.5.4.13_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.13_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.14_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.15_String.prototype.substring/S15.5.4.15_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.15_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.6_String.prototype.concat/S15.5.4.6_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.6_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.7_String.prototype.indexOf/S15.5.4.7_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.7_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/LayoutTests/sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.8_String.prototype.lastIndexOf/S15.5.4.8_A1_T3-expected.txt

    r91344 r153145  
    11S15.5.4.8_A1_T3
    22
    3 FAIL TypeError: Type error
     3PASS
    44
    55TEST COMPLETE

  • trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp

    r148696 r153145  
    6868    JSContextRef execRef = toRef(exec);
    6969    JSObjectRef functionRef = toRef(exec->callee());
    70     JSObjectRef thisObjRef = toRef(exec->hostThisValue().toThisObject(exec));
     70    JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(exec->hostThisValue().toThis(exec, NotStrictMode)));
    7171
    7272    size_t argumentCount = exec->argumentCount();

  • trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h

    r150990 r153145  
    491491    JSContextRef execRef = toRef(exec);
    492492    JSObjectRef functionRef = toRef(exec->callee());
    493     JSObjectRef thisObjRef = toRef(exec->hostThisValue().toThisObject(exec));
     493    JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(exec->hostThisValue().toThis(exec, NotStrictMode)));
    494494   
    495495    for (JSClassRef jsClass = jsCast<JSCallbackObject<Parent>*>(toJS(functionRef))->classRef(); jsClass; jsClass = jsClass->parentClass) {

  • trunk/Source/JavaScriptCore/API/JSContextRef.cpp

    r152494 r153145  
    136136    if (!globalObjectClass) {
    137137        JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
     138        globalObject->setGlobalThis(*vm, JSProxy::create(*vm, JSProxy::createStructure(*vm, globalObject, globalObject->prototype()), globalObject));
    138139        return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
    139140    }
    … …  
    187188    APIEntryShim entryShim(exec);
    188189
    189     // It is necessary to call toThisObject to get the wrapper object when used with WebCore.
    190     return toRef(exec->lexicalGlobalObject()->methodTable()->toThisObject(exec->lexicalGlobalObject(), exec));
     190    return toRef(jsCast<JSObject*>(exec->lexicalGlobalObject()->methodTable()->toThis(exec->lexicalGlobalObject(), exec, NotStrictMode)));
    191191}
    192192

  • trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

    r150381 r153145  
    278278    JSValue jsValue = toJS(exec, value);
    279279
    280     jsObject->setPrototypeWithCycleCheck(exec->vm(), jsValue.isObject() ? jsValue : jsNull());
     280    jsObject->setPrototypeWithCycleCheck(exec, jsValue.isObject() ? jsValue : jsNull());
    281281}
    282282
    … …  
    529529        jsThisObject = exec->globalThisValue();
    530530
    531     jsThisObject = jsThisObject->methodTable()->toThisObject(jsThisObject, exec);
    532    
    533531    MarkedArgumentBuffer argList;
    534532    for (size_t i = 0; i < argumentCount; i++)

  • trunk/Source/JavaScriptCore/ChangeLog

    r153144 r153145  
     12013-05-06  Mark Lam  <mark.lam@apple.com>
     2
     3        Fix broken 32-bit build + some clean up in JITStubs.cpp.
     4        https://bugs.webkit.org/show_bug.cgi?id=115684.
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        * dfg/DFGSpeculativeJIT32_64.cpp:
     9        (JSC::DFG::SpeculativeJIT::compile):
     10        * jit/JITStubs.cpp:
     11        - removed unneeded stubs for CPU(X86_64) && USE(JSVALUE32_64).
     12        - added some line breaks to more clearly delineate between
     13          ports/configurations of stub code.
     14
     152013-05-05  Geoffrey Garen  <ggaren@apple.com>
     16
     17        Rolled back in r149527 with crash fixed.
     18
     19        Reviewed by Oliver Hunt.
     20
     21            Rationalized 'this' value conversion
     22            https://bugs.webkit.org/show_bug.cgi?id=115542
     23
     24            This fixes a bunch of Sputnik tests, and some bad pointer access.
     25
     26            The new model is that the callee always performs 'this' value conversion.
     27
     28            My ultimate goal is to break up resolve_with_this into single-result
     29            opcodes. This step avoids having to add a special form of convert_this
     30            that distinguishes callers vs callees.
     31
     32            Only the callee knows whether it uses 'this' and/or whether 'this'
     33            conversion should use StrictMode, so it's most natural to perform
     34            convert_this in the callee.
     35
     36            * API/JSCallbackFunction.cpp:
     37            (JSC::JSCallbackFunction::call): Perform 'this' value conversion for
     38            our callee, since it may observe 'this'.
     39
     40            * API/JSCallbackObjectFunctions.h:
     41            (JSC::::call): Ditto.
     42
     43            * API/JSContextRef.cpp:
     44            (JSGlobalContextCreateInGroup): Use a proxy 'this' object in global scope
     45            even when we're not in the browser. This eliminates some odd cases where
     46            API clients used to be able to get a direct reference to an environment
     47            record. Now, any reference to an environment record unambiguously means
     48            that the VM resolved that record in the scope chain.
     49
     50            (JSContextGetGlobalObject): Removed an incorrect comment. Now that JSC
     51            participates in the proxy 'this' object scheme, the behavior is not
     52            WebCore-only.
     53
     54            * API/JSObjectRef.cpp:
     55            (JSObjectSetPrototype):
     56            (JSObjectCallAsFunction): Don't perform 'this' value conversion in the
     57            caller; the callee will do it if needed.
     58
     59            * JavaScriptCore.order: Order!
     60
     61            * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
     62            * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
     63            What are the chances that this will work?
     64
     65            * bytecode/CodeBlock.cpp:
     66            (JSC::CodeBlock::dumpBytecode):
     67            (JSC::CodeBlock::CodeBlock): Renamed convert_this to to_this, to match our
     68            other conversion opcodes.
     69
     70            * bytecode/CodeOrigin.h:
     71            (CodeOrigin):
     72            (InlineCallFrame):
     73            (JSC::CodeOrigin::codeOriginOwner): Use the more precise type for our
     74            executable, so compilation can discover where we're in strict mode.
     75
     76            * bytecode/Opcode.h:
     77            (JSC::padOpcodeName): Updated for rename.
     78
     79            * bytecompiler/BytecodeGenerator.cpp:
     80            (JSC::BytecodeGenerator::BytecodeGenerator): Always emit to_this when
     81            'this' is in use -- strict mode still needs to convert environment
     82            records to 'undefined'.
     83
     84            * dfg/DFGAbstractState.cpp:
     85            (JSC::DFG::AbstractState::executeEffects):
     86            * dfg/DFGByteCodeParser.cpp:
     87            (JSC::DFG::ByteCodeParser::parseBlock):
     88            * dfg/DFGCapabilities.h:
     89            (JSC::DFG::canCompileOpcode): Updated for renames.
     90
     91            * dfg/DFGFixupPhase.cpp:
     92            (JSC::DFG::FixupPhase::fixupNode): Tightened up this code to consider
     93            strict mode (a new requirement) and to consider the global object (which
     94            was always a requirement).
     95
     96            * dfg/DFGGraph.h:
     97            (JSC::DFG::Graph::globalThisObjectFor):
     98            (JSC::DFG::Graph::executableFor):
     99            * dfg/DFGNodeType.h:
     100            * dfg/DFGOperations.cpp:
     101            * dfg/DFGOperations.h:
     102            * dfg/DFGPredictionPropagationPhase.cpp:
     103            (JSC::DFG::PredictionPropagationPhase::propagate):
     104            * dfg/DFGSpeculativeJIT32_64.cpp:
     105            (JSC::DFG::SpeculativeJIT::compile):
     106            * dfg/DFGSpeculativeJIT64.cpp:
     107            (JSC::DFG::SpeculativeJIT::compile): Ditto.
     108
     109            * interpreter/Interpreter.cpp:
     110            (JSC::eval):
     111            (JSC::Interpreter::execute):
     112            (JSC::Interpreter::executeCall):
     113            * interpreter/Interpreter.h: Don't ASSERT about 'this' -- it's our job
     114            to fix it up if needed.
     115
     116            * jit/JIT.cpp:
     117            (JSC::JIT::privateCompileMainPass):
     118            (JSC::JIT::privateCompileSlowCases):
     119            * jit/JIT.h:
     120            (JIT):
     121            * jit/JITOpcodes.cpp:
     122            (JSC::JIT::emit_op_to_this):
     123            (JSC::JIT::emitSlow_op_to_this):
     124            * jit/JITOpcodes32_64.cpp:
     125            (JSC::JIT::emit_op_to_this):
     126            (JSC::JIT::emitSlow_op_to_this):
     127            * jit/JITStubs.cpp:
     128            (JSC::DEFINE_STUB_FUNCTION):
     129            * jit/JITStubs.h: Removed special-case code for various kinds of
     130            conversions. The baseline fast path is now final objects only. It hurt
     131            my brain to think through how to keep the other fast paths working, and
     132            our benchmarks do not object.
     133
     134            * llint/LLIntData.cpp:
     135            (JSC::LLInt::Data::performAssertions):
     136            * llint/LLIntSlowPaths.cpp:
     137            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
     138            * llint/LLIntSlowPaths.h:
     139            (LLInt):
     140            * llint/LowLevelInterpreter.asm:
     141            * llint/LowLevelInterpreter32_64.asm:
     142            * llint/LowLevelInterpreter64.asm: Updated for renames. Removed some
     143            special case code, as in the JIT above.
     144
     145            * profiler/ProfileGenerator.cpp:
     146            (JSC::ProfileGenerator::addParentForConsoleStart):
     147            * runtime/CallData.cpp:
     148            (JSC::call):
     149            * runtime/ClassInfo.h:
     150            (MethodTable):
     151            * runtime/Completion.cpp:
     152            (JSC::evaluate):
     153            * runtime/DatePrototype.cpp:
     154            (JSC::dateProtoFuncToJSON): The callee performs 'this' conversion, not
     155            the caller.
     156
     157            * runtime/GetterSetter.cpp:
     158            (JSC::callGetter):
     159            (JSC::callSetter):
     160            * runtime/GetterSetter.h: Added helper functions for invoking getters
     161            and setters from C++ code, since this was duplicated in a bunch of
     162            places.
     163
     164            * runtime/JSActivation.cpp:
     165            (JSC::JSActivation::toThis):
     166            * runtime/JSActivation.h:
     167            (JSActivation):
     168            * runtime/JSCJSValue.cpp:
     169            (JSC::JSValue::toThisSlowCase):
     170            (JSC::JSValue::putToPrimitive):
     171            * runtime/JSCJSValue.h:
     172            (JSValue):
     173            * runtime/JSCJSValueInlines.h:
     174            (JSC::JSValue::toThis):
     175            * runtime/JSCell.cpp:
     176            (JSC::JSCell::toThis):
     177            * runtime/JSCell.h:
     178            (JSCell):
     179            * runtime/JSGlobalObject.cpp:
     180            (JSC::JSGlobalObject::toThis):
     181            * runtime/JSGlobalObject.h:
     182            (JSGlobalObject): Filled out runtime support for converting 'this'
     183            values as needed, according to the appropriate strictness, using
     184            helper functions where getter/setter code was duplicated.
     185
     186            * runtime/JSGlobalObjectFunctions.cpp:
     187            (JSC::globalFuncProtoGetter):
     188            (JSC::globalFuncProtoSetter): Perform 'this' value conversion, since we
     189            observe 'this'.
     190
     191            * runtime/JSNameScope.cpp:
     192            (JSC::JSNameScope::toThis):
     193            * runtime/JSNameScope.h:
     194            (JSNameScope): Same as JSActivation.
     195
     196            * runtime/JSObject.cpp:
     197            (JSC::JSObject::put):
     198            (JSC::JSObject::setPrototypeWithCycleCheck): Bug fix. Don't peform
     199            'this' value conversion in this helper function. The __proto__
     200            setter does this for us, since it's the function that logically observes
     201            'this' -- and we can ASSERT so. Also, the previous code used
     202            "globalExec()->thisValue()", which is a read past the beginning of a
     203            buffer! I don't think this ever worked on purpose.
     204
     205            (JSC::JSObject::toThis):
     206            (JSC::JSObject::fillGetterPropertySlot):
     207            * runtime/JSObject.h:
     208            (JSC::JSObject::inlineGetOwnPropertySlot):
     209            * runtime/JSScope.cpp:
     210            (JSC::JSScope::resolveWithThis):
     211            * runtime/JSString.cpp:
     212            (JSC::JSString::toThis):
     213            * runtime/JSString.h:
     214            (JSString):
     215            * runtime/PropertySlot.cpp:
     216            (JSC::PropertySlot::functionGetter):
     217            * runtime/PropertySlot.h:
     218            (JSC):
     219            (JSC::PropertySlot::setGetterSlot):
     220            (JSC::PropertySlot::setCacheableGetterSlot):
     221            * runtime/SparseArrayValueMap.cpp:
     222            (JSC::SparseArrayEntry::get):
     223            (JSC::SparseArrayEntry::put):
     224            * runtime/StrictEvalActivation.cpp:
     225            (JSC::StrictEvalActivation::toThis):
     226            * runtime/StrictEvalActivation.h:
     227            (StrictEvalActivation): Ditto.
     228
    12292013-05-03  Filip Pizlo  <fpizlo@apple.com>
    2230

  • trunk/Source/JavaScriptCore/JavaScriptCore.order

    r150833 r153145  
    338338__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
    339339_JSContextGetGlobalObject
    340 __ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
    341340_JSStringCreateWithUTF8CString
    342341_JSObjectGetProperty
    … …  
    813812_JSValueMakeString
    814813__ZN3JSC8ThisNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
    815 __ZN3JSC3JIT20emit_op_convert_thisEPNS_11InstructionE
    816814__ZN3JSC23MacroAssemblerX86Common11branchTest8ENS0_15ResultConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS4_12TrustedImm32E
    817 __ZN3JSC3JIT24emitSlow_op_convert_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
    818815__ZN3JSC8JSObject13visitChildrenERNS_9MarkStackE
    819816__ZN3JSC14JSGlobalObject13visitChildrenERNS_9MarkStackE
    … …  
    990987__ZN3WTF7HashMapINS_6RefPtrINS_10StringImplEEEN3JSC12WriteBarrierINS4_14EvalExecutableEEENS_10StringHashENS_10HashTraitsIS3_EENS9_IS7_EEE3setEPS2_RKS7_
    991988__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEESt4pairIS3_N3JSC12WriteBarrierINS5_14EvalExecutableEEEENS_18PairFirstExtractorIS9_EENS_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E6expandEv
    992 __ZNK3JSC7JSValue20toThisObjectSlowCaseEPNS_9ExecStateE
    993989__ZN3JSC11Interpreter7executeEPNS_14EvalExecutableEPNS_9ExecStateEPNS_8JSObjectEiPNS_14ScopeChainNodeE
    994990_cti_op_resolve
    … …  
    14371433__ZNK3JSC8NullNode6isNullEv
    14381434__ZN3JSC3JIT17emit_op_jneq_nullEPNS_11InstructionE
    1439 _cti_op_convert_this
    14401435_cti_vm_lazyLinkConstruct
    14411436__ZN3JSC18FunctionExecutable27compileForConstructInternalEPNS_9ExecStateEPNS_14ScopeChainNodeE
    … …  
    15591554__ZN3JSC3JIT27emit_op_get_argument_by_valEPNS_11InstructionE
    15601555__ZN3JSC3JIT31emitSlow_op_get_argument_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
    1561 __ZNK3JSC8JSString12toThisObjectEPNS_9ExecStateE
    15621556__ZN3JSCL20arrayProtoFuncSpliceEPNS_9ExecStateE
    15631557__ZN3JSC7JSArray9setLengthEj
    … …  
    20232017__ZN3JSCL26stringFromCharCodeSlowCaseEPNS_9ExecStateE
    20242018__ZN3JSCL25stringProtoFuncCharCodeAtEPNS_9ExecStateE
    2025 __ZNK3JSC12JSActivation12toThisObjectEPNS_9ExecStateE
    20262019__ZN3JSC12StringObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
    20272020__ZN3JSC9ExecState11stringTableEPS0_
    … …  
    22702263__ZN3JSCL20arrayProtoFuncReduceEPNS_9ExecStateE
    22712264__ZN3JSCL25arrayProtoFuncReduceRightEPNS_9ExecStateE
    2272 __ZN3JSC3JIT27emit_op_convert_this_strictEPNS_11InstructionE
    2273 __ZN3JSC3JIT31emitSlow_op_convert_this_strictEPNS_11InstructionERPNS_13SlowCaseEntryE
    22742265__ZN3JSC9Arguments33createStrictModeCalleeIfNecessaryEPNS_9ExecStateE
    22752266__ZN3JSC23createTypeErrorFunctionEPNS_9ExecStateERKNS_7UStringE
    … …  
    23402331__ZN3JSCL29objectConstructorIsExtensibleEPNS_9ExecStateE
    23412332__ZN3JSC4Yarr25CharacterClassConstructor9addSortedERN3WTF6VectorItLm0EEEt
    2342 __ZNK3JSC19JSStaticScopeObject12toThisObjectEPNS_9ExecStateE
    23432333__ZN3JSCL23stringProtoFuncTrimLeftEPNS_9ExecStateE
    23442334__ZN3JSCL24stringProtoFuncTrimRightEPNS_9ExecStateE

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r153142 r153145  
    717717            break;
    718718        }
    719         case op_convert_this: {
    720             int r0 = (++it)->u.operand;
    721             out.printf("[%4d] convert_this\t %s", location, registerName(r0).data());
     719        case op_to_this: {
     720            int r0 = (++it)->u.operand;
     721            out.printf("[%4d] to_this\t %s", location, registerName(r0).data());
    722722            ++it; // Skip value profile.
    723723            break;
    … …  
    17751775            // fallthrough
    17761776        }
    1777         case op_convert_this:
     1777        case op_to_this:
    17781778        case op_get_by_id:
    17791779        case op_call_put_result:

  • trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

    r153142 r153145  
    4040struct InlineCallFrame;
    4141class ExecState;
    42 class ExecutableBase;
     42class ScriptExecutable;
    4343class JSFunction;
    4444
    … …  
    8383    // If the code origin corresponds to inlined code, gives you the heap object that
    8484    // would have owned the code if it had not been inlined. Otherwise returns 0.
    85     ExecutableBase* codeOriginOwner() const;
     85    ScriptExecutable* codeOriginOwner() const;
    8686   
    8787    unsigned stackOffset() const;
    … …  
    101101struct InlineCallFrame {
    102102    Vector<ValueRecovery> arguments;
    103     WriteBarrier<ExecutableBase> executable;
     103    WriteBarrier<ScriptExecutable> executable;
    104104    WriteBarrier<JSFunction> callee; // This may be null, indicating that this is a closure call and that the JSFunction and JSScope are already on the stack.
    105105    CodeOrigin caller;
    … …  
    150150}
    151151
    152 inline ExecutableBase* CodeOrigin::codeOriginOwner() const
     152inline ScriptExecutable* CodeOrigin::codeOriginOwner() const
    153153{
    154154    if (!inlineCallFrame)

  • trunk/Source/JavaScriptCore/bytecode/Opcode.h

    r149418 r153145  
    4747    macro(op_create_this, 4) \
    4848    macro(op_get_callee, 3) \
    49     macro(op_convert_this, 3) \
     49    macro(op_to_this, 3) \
    5050    \
    5151    macro(op_new_object, 4) \

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r153132 r153145  
    396396    if (isConstructor()) {
    397397        emitCreateThis(&m_thisRegister);
    398     } else if (!codeBlock->isStrictMode() && (functionBody->usesThis() || codeBlock->usesEval() || m_shouldEmitDebugHooks)) {
    399         UnlinkedValueProfile profile = emitProfiledOpcode(op_convert_this);
     398    } else if (functionBody->usesThis() || codeBlock->usesEval() || m_shouldEmitDebugHooks) {
     399        UnlinkedValueProfile profile = emitProfiledOpcode(op_to_this);
    400400        instructions().append(kill(&m_thisRegister));
    401401        instructions().append(profile);

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

    r153142 r153145  
    11401140        break;
    11411141           
    1142     case ConvertThis: {
     1142    case ToThis: {
    11431143        AbstractValue& source = forNode(node->child1());
    11441144        AbstractValue& destination = forNode(node);

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r153144 r153145  
    20262026            NEXT_OPCODE(op_enter);
    20272027
    2028         case op_convert_this: {
     2028        case op_to_this: {
    20292029            Node* op1 = getThis();
    2030             if (op1->op() != ConvertThis) {
     2030            if (op1->op() != ToThis) {
    20312031                CodeBlockLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
    20322032                ValueProfile* profile =
    … …  
    20422042                    || !profile->m_singletonValue.isCell()
    20432043                    || profile->m_singletonValue.asCell()->classInfo() != &Structure::s_info)
    2044                     setThis(addToGraph(ConvertThis, op1));
     2044                    setThis(addToGraph(ToThis, op1));
    20452045                else {
    20462046                    addToGraph(
    … …  
    20502050                }
    20512051            }
    2052             NEXT_OPCODE(op_convert_this);
     2052            NEXT_OPCODE(op_to_this);
    20532053        }
    20542054

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.h

    r149247 r153145  
    8787    switch (opcodeID) {
    8888    case op_enter:
    89     case op_convert_this:
     89    case op_to_this:
    9090    case op_create_this:
    9191    case op_get_callee:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r153142 r153145  
    636636        }
    637637           
    638         case ConvertThis: {
     638        case ToThis: {
     639            ECMAMode ecmaMode = m_graph.executableFor(node->codeOrigin)->isStrictMode() ? StrictMode : NotStrictMode;
     640
    639641            if (isOtherSpeculation(node->child1()->prediction())) {
     642                if (ecmaMode == StrictMode) {
     643                    setUseKindAndUnboxIfProfitable<OtherUse>(node->child1());
     644                    node->convertToIdentity();
     645                    break;
     646                }
     647
    640648                m_insertionSet.insertNode(
    641649                    m_indexInBlock, SpecNone, Phantom, node->codeOrigin,
    … …  
    646654            }
    647655           
    648             if (isObjectSpeculation(node->child1()->prediction())) {
     656            if (isFinalObjectSpeculation(node->child1()->prediction())) {
    649657                setUseKindAndUnboxIfProfitable<ObjectUse>(node->child1());
    650658                node->convertToIdentity();

  • trunk/Source/JavaScriptCore/dfg/DFGGraph.h

    r153142 r153145  
    358358    {
    359359        JSGlobalObject* object = globalObjectFor(codeOrigin);
    360         return object->methodTable()->toThisObject(object, 0);
    361     }
    362    
    363     ExecutableBase* executableFor(InlineCallFrame* inlineCallFrame)
     360        return jsCast<JSObject*>(object->methodTable()->toThis(object, object->globalExec(), NotStrictMode));
     361    }
     362   
     363    ScriptExecutable* executableFor(InlineCallFrame* inlineCallFrame)
    364364    {
    365365        if (!inlineCallFrame)
    … …  
    369369    }
    370370   
    371     ExecutableBase* executableFor(const CodeOrigin& codeOrigin)
     371    ScriptExecutable* executableFor(const CodeOrigin& codeOrigin)
    372372    {
    373373        return executableFor(codeOrigin.inlineCallFrame);

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r153121 r153145  
    5050    \
    5151    /* Nodes for handling functions (both as call and as construct). */\
    52     macro(ConvertThis, NodeResultJS) \
     52    macro(ToThis, NodeResultJS) \
    5353    macro(CreateThis, NodeResultJS) /* Note this is not MustGenerate since we're returning it anyway. */ \
    5454    macro(GetCallee, NodeResultJS) \

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r153142 r153145  
    342342extern "C" {
    343343
    344 EncodedJSValue DFG_OPERATION operationConvertThis(ExecState* exec, EncodedJSValue encodedOp)
    345 {
    346     VM* vm = &exec->vm();
    347     NativeCallFrameTracer tracer(vm, exec);
    348 
    349     return JSValue::encode(JSValue::decode(encodedOp).toThisObject(exec));
     344EncodedJSValue DFG_OPERATION operationToThis(ExecState* exec, EncodedJSValue encodedOp)
     345{
     346    VM* vm = &exec->vm();
     347    NativeCallFrameTracer tracer(vm, exec);
     348
     349    return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
    350350}
    351351
    … …  
    571571}
    572572
    573 EncodedJSValue DFG_OPERATION operationCallGetter(ExecState* exec, JSCell* base, JSCell* value)
    574 {
    575     VM* vm = &exec->vm();
    576     NativeCallFrameTracer tracer(vm, exec);
    577    
    578     GetterSetter* getterSetter = asGetterSetter(value);
    579     JSObject* getter = getterSetter->getter();
    580     if (!getter)
    581         return JSValue::encode(jsUndefined());
    582     CallData callData;
    583     CallType callType = getter->methodTable()->getCallData(getter, callData);
    584     return JSValue::encode(call(exec, getter, callType, callData, asObject(base), ArgList()));
     573EncodedJSValue DFG_OPERATION operationCallGetter(ExecState* exec, JSCell* base, JSCell* getterSetter)
     574{
     575    VM* vm = &exec->vm();
     576    NativeCallFrameTracer tracer(vm, exec);
     577
     578    return JSValue::encode(callGetter(exec, base, getterSetter));
    585579}
    586580

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.h

    r153142 r153145  
    133133JSCell* DFG_OPERATION operationNewObject(ExecState*, Structure*) WTF_INTERNAL;
    134134JSCell* DFG_OPERATION operationCreateThis(ExecState*, JSObject* constructor, int32_t inlineCapacity) WTF_INTERNAL;
    135 EncodedJSValue DFG_OPERATION operationConvertThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
     135EncodedJSValue DFG_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
    136136EncodedJSValue DFG_OPERATION operationValueAdd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
    137137EncodedJSValue DFG_OPERATION operationValueAddNotNumber(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r152813 r153145  
    382382        }
    383383
    384         case ConvertThis: {
     384        case ToThis: {
    385385            SpeculatedType prediction = node->child1()->prediction();
    386386            if (prediction) {

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r153142 r153145  
    36953695    }
    36963696       
    3697     case ConvertThis: {
     3697    case ToThis: {
    36983698        ASSERT(node->child1().useKind() == UntypedUse);
    36993699
    … …  
    37063706        GPRResult2 resultTag(this);
    37073707        GPRResult resultPayload(this);
    3708         callOperation(operationConvertThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);
     3708        callOperation(operationToThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);
    37093709       
    37103710        cellResult(resultPayload.gpr(), node);

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r153142 r153145  
    36083608    }
    36093609       
    3610     case ConvertThis: {
     3610    case ToThis: {
    36113611        ASSERT(node->child1().useKind() == UntypedUse);
    36123612        JSValueOperand thisValue(this, node->child1());
    … …  
    36163616       
    36173617        GPRResult result(this);
    3618         callOperation(operationConvertThis, result.gpr(), thisValueGPR);
     3618        callOperation(operationToThis, result.gpr(), thisValueGPR);
    36193619       
    36203620        cellResult(result.gpr(), node);

  • trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

    r153115 r153145  
    156156
    157157    JSValue thisValue = callerFrame->thisValue();
    158     ASSERT(isValidThisObject(thisValue, callFrame));
    159158    Interpreter* interpreter = callFrame->vm().interpreter;
    160159    return interpreter->execute(eval, callFrame, thisValue, callerScopeChain);
    … …  
    799798    VM& vm = *scope->vm();
    800799
    801     ASSERT(isValidThisObject(thisObj, callFrame));
    802800    ASSERT(!vm.exception);
    803801    ASSERT(!vm.isCollectorBusy());
    … …  
    964962{
    965963    VM& vm = callFrame->vm();
    966     ASSERT(isValidThisObject(thisValue, callFrame));
    967964    ASSERT(!callFrame->hadException());
    968965    ASSERT(!vm.isCollectorBusy());
    … …  
    12211218   
    12221219    ASSERT(scope->vm() == &callFrame->vm());
    1223     ASSERT(isValidThisObject(thisValue, callFrame));
    12241220    ASSERT(!vm.exception);
    12251221    ASSERT(!vm.isCollectorBusy());

  • trunk/Source/JavaScriptCore/interpreter/Interpreter.h

    r152494 r153145  
    265265    };
    266266
    267     // This value must not be an object that would require this conversion (WebCore's global object).
    268     inline bool isValidThisObject(JSValue thisValue, ExecState* exec)
    269     {
    270         return !thisValue.isObject() || thisValue.toThisObject(exec) == thisValue;
    271     }
    272 
    273267    JSValue eval(CallFrame*);
    274268    CallFrame* loadVarargs(CallFrame*, JSStack*, JSValue thisValue, JSValue arguments, int firstFreeRegister);

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r153143 r153145  
    229229        DEFINE_OP(op_get_callee)
    230230        DEFINE_OP(op_create_this)
    231         DEFINE_OP(op_convert_this)
     231        DEFINE_OP(op_to_this)
    232232        DEFINE_OP(op_init_lazy_reg)
    233233        DEFINE_OP(op_create_arguments)
    … …  
    432432        DEFINE_SLOWCASE_OP(op_call_varargs)
    433433        DEFINE_SLOWCASE_OP(op_construct)
    434         DEFINE_SLOWCASE_OP(op_convert_this)
     434        DEFINE_SLOWCASE_OP(op_to_this)
    435435        DEFINE_SLOWCASE_OP(op_create_this)
    436436        DEFINE_SLOWCASE_OP(op_div)

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r153113 r153145  
    654654        void emit_op_get_callee(Instruction*);
    655655        void emit_op_create_this(Instruction*);
    656         void emit_op_convert_this(Instruction*);
     656        void emit_op_to_this(Instruction*);
    657657        void emit_op_create_arguments(Instruction*);
    658658        void emit_op_debug(Instruction*);
    … …  
    757757        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
    758758        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
    759         void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
     759        void emitSlow_op_to_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
    760760        void emitSlow_op_create_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
    761761        void emitSlow_op_div(Instruction*, Vector<SlowCaseEntry>::iterator&);

  • trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

    r149418 r153145  
    888888}
    889889
    890 void JIT::emit_op_convert_this(Instruction* currentInstruction)
     890void JIT::emit_op_to_this(Instruction* currentInstruction)
    891891{
    892892    emitGetVirtualRegister(currentInstruction[1].u.operand, regT1);
    893893
    894894    emitJumpSlowCaseIfNotJSCell(regT1);
    895     if (shouldEmitProfiling()) {
    896         loadPtr(Address(regT1, JSCell::structureOffset()), regT0);
     895    loadPtr(Address(regT1, JSCell::structureOffset()), regT0);
     896    if (shouldEmitProfiling())
    897897        emitValueProfilingSite();
    898     }
    899     addSlowCase(branchPtr(Equal, Address(regT1, JSCell::structureOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
     898
     899    addSlowCase(branch8(NotEqual, Address(regT0, Structure::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
    900900}
    901901
    … …  
    953953// Slow cases
    954954
    955 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    956 {
    957     void* globalThis = m_codeBlock->globalObject()->globalThis();
    958 
    959     linkSlowCase(iter);
    960     if (shouldEmitProfiling())
    961         move(TrustedImm64((JSValue::encode(jsUndefined()))), regT0);
    962     Jump isNotUndefined = branch64(NotEqual, regT1, TrustedImm64(JSValue::encode(jsUndefined())));
    963     emitValueProfilingSite();
    964     move(TrustedImm64(JSValue::encode(JSValue(static_cast<JSCell*>(globalThis)))), regT0);
    965     emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
    966     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_convert_this));
    967 
    968     linkSlowCase(iter);
    969     if (shouldEmitProfiling())
    970         move(TrustedImm64(JSValue::encode(m_vm->stringStructure.get())), regT0);
    971     isNotUndefined.link(this);
    972     emitValueProfilingSite();
    973     JITStubCall stubCall(this, cti_op_convert_this);
     955void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
     956{
     957    linkSlowCase(iter);
     958    linkSlowCase(iter);
     959    JITStubCall stubCall(this, cti_op_to_this);
    974960    stubCall.addArgument(regT1);
    975961    stubCall.call(currentInstruction[1].u.operand);

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r150569 r153145  
    11811181}
    11821182
    1183 void JIT::emit_op_convert_this(Instruction* currentInstruction)
     1183void JIT::emit_op_to_this(Instruction* currentInstruction)
    11841184{
    11851185    unsigned thisRegister = currentInstruction[1].u.operand;
    … …  
    11881188
    11891189    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag)));
     1190    loadPtr(Address(regT2, JSCell::structureOffset()), regT0);
    11901191    if (shouldEmitProfiling()) {
    1191         loadPtr(Address(regT2, JSCell::structureOffset()), regT0);
    11921192        move(regT3, regT1);
    11931193        emitValueProfilingSite();
    11941194    }
    1195     addSlowCase(branchPtr(Equal, Address(regT2, JSCell::structureOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
    1196 }
    1197 
    1198 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    1199 {
    1200     void* globalThis = m_codeBlock->globalObject()->globalThis();
     1195    addSlowCase(branch8(NotEqual, Address(regT0, Structure::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
     1196}
     1197
     1198void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
     1199{
    12011200    unsigned thisRegister = currentInstruction[1].u.operand;
    12021201
    12031202    linkSlowCase(iter);
    1204     if (shouldEmitProfiling()) {
    1205         move(TrustedImm32(JSValue::UndefinedTag), regT1);
    1206         move(TrustedImm32(0), regT0);
    1207     }
    1208     Jump isNotUndefined = branch32(NotEqual, regT3, TrustedImm32(JSValue::UndefinedTag));
    1209     emitValueProfilingSite();
    1210     move(TrustedImmPtr(globalThis), regT0);
    1211     move(TrustedImm32(JSValue::CellTag), regT1);
    1212     emitStore(thisRegister, regT1, regT0);
    1213     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_convert_this));
    1214 
    1215     linkSlowCase(iter);
    1216     if (shouldEmitProfiling()) {
    1217         move(TrustedImm32(JSValue::CellTag), regT1);
    1218         move(TrustedImmPtr(m_vm->stringStructure.get()), regT0);
    1219     }
    1220     isNotUndefined.link(this);
    1221     emitValueProfilingSite();
    1222     JITStubCall stubCall(this, cti_op_convert_this);
     1203    linkSlowCase(iter);
     1204    JITStubCall stubCall(this, cti_op_to_this);
    12231205    stubCall.addArgument(regT3, regT2);
    12241206    stubCall.call(thisRegister);

  • trunk/Source/JavaScriptCore/jit/JITStubs.cpp

    r153123 r153145  
    138138);
    139139   
    140 #elif COMPILER(GCC) && CPU(X86_64)
    141 
    142 // These ASSERTs remind you that, if you change the layout of JITStackFrame, you
    143 // need to change the assembly trampolines below to match.
    144 COMPILE_ASSERT(offsetof(struct JITStackFrame, code) % 32 == 0x0, JITStackFrame_maintains_32byte_stack_alignment);
    145 COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x48, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
    146 COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x90, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
    147 COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_offset_matches_ctiTrampoline);
    148 
    149 asm (
    150 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
    151 HIDE_SYMBOL(ctiTrampoline) "\n"
    152 SYMBOL_STRING(ctiTrampoline) ":" "\n"
    153     "pushq %rbp" "\n"
    154     "movq %rsp, %rbp" "\n"
    155     "pushq %r12" "\n"
    156     "pushq %r13" "\n"
    157     "pushq %r14" "\n"
    158     "pushq %r15" "\n"
    159     "pushq %rbx" "\n"
    160     "subq $0x48, %rsp" "\n"
    161     "movq $512, %r12" "\n"
    162     "movq $0xFFFF000000000000, %r14" "\n"
    163     "movq $0xFFFF000000000002, %r15" "\n"
    164     "movq 0x90(%rsp), %r13" "\n"
    165     "call *0x80(%rsp)" "\n"
    166     "addq $0x48, %rsp" "\n"
    167     "popq %rbx" "\n"
    168     "popq %r15" "\n"
    169     "popq %r14" "\n"
    170     "popq %r13" "\n"
    171     "popq %r12" "\n"
    172     "popq %rbp" "\n"
    173     "ret" "\n"
    174 ".globl " SYMBOL_STRING(ctiTrampolineEnd) "\n"
    175 HIDE_SYMBOL(ctiTrampolineEnd) "\n"
    176 SYMBOL_STRING(ctiTrampolineEnd) ":" "\n"
    177 );
    178 
    179 asm (
    180 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
    181 HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
    182 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
    183     "movq %rsp, %rdi" "\n"
    184     "call " LOCAL_REFERENCE(cti_vm_throw) "\n"
    185     "int3" "\n"
    186 );
    187 
    188 asm (
    189 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
    190 HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
    191 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
    192     "addq $0x48, %rsp" "\n"
    193     "popq %rbx" "\n"
    194     "popq %r15" "\n"
    195     "popq %r14" "\n"
    196     "popq %r13" "\n"
    197     "popq %r12" "\n"
    198     "popq %rbp" "\n"
    199     "ret" "\n"
    200 );
    201 
    202140#elif (COMPILER(GCC) || COMPILER(RVCT)) && CPU(ARM_THUMB2)
    203141
    … …  
    294232#define GLOBAL_DATA_OFFSET         108
    295233#define STACK_LENGTH               112
     234
    296235#elif CPU(SH4)
     236
    297237#define SYMBOL_STRING(name) #name
    298238/* code (r4), JSStack* (r5), CallFrame* (r6), void* unused1 (r7), void* unused2(sp), VM (sp)*/
    … …  
    14571397}
    14581398
    1459 DEFINE_STUB_FUNCTION(EncodedJSValue, op_convert_this)
     1399DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_this)
    14601400{
    14611401    STUB_INIT_STACK_FRAME(stackFrame);
    … …  
    14641404    CallFrame* callFrame = stackFrame.callFrame;
    14651405
    1466     ASSERT(v1.isPrimitive());
    1467 
    1468     JSObject* result = v1.toThisObject(callFrame);
     1406    JSValue result = v1.toThis(callFrame, callFrame->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode);
    14691407    CHECK_FOR_EXCEPTION_AT_END();
    14701408    return JSValue::encode(result);
    … …  
    17821720    STUB_INIT_STACK_FRAME(stackFrame);
    17831721    CallFrame* callFrame = stackFrame.callFrame;
    1784     GetterSetter* getterSetter = asGetterSetter(stackFrame.args[0].jsObject());
    1785     if (!getterSetter->getter())
    1786         return JSValue::encode(jsUndefined());
    1787     JSObject* getter = asObject(getterSetter->getter());
    1788     CallData callData;
    1789     CallType callType = getter->methodTable()->getCallData(getter, callData);
    1790     JSValue result = call(callFrame, getter, callType, callData, stackFrame.args[1].jsObject(), ArgList());
     1722    JSValue result = callGetter(callFrame, stackFrame.args[1].jsObject(), stackFrame.args[0].jsObject());
    17911723    if (callFrame->hadException())
    17921724        returnToThrowTrampoline(&callFrame->vm(), stackFrame.args[2].returnAddress(), STUB_RETURN_ADDRESS);

  • trunk/Source/JavaScriptCore/jit/JITStubs.h

    r150146 r153145  
    330330EncodedJSValue JIT_STUB cti_op_check_has_instance(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    331331EncodedJSValue JIT_STUB cti_op_create_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    332 EncodedJSValue JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     332EncodedJSValue JIT_STUB cti_op_to_this(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    333333EncodedJSValue JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION) WTF_INTERNAL;
    334334EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION) WTF_INTERNAL;

  • trunk/Source/JavaScriptCore/llint/LLIntData.cpp

    r152206 r153145  
    105105    ASSERT(StringType == 5);
    106106    ASSERT(ObjectType == 17);
     107    ASSERT(FinalObjectType == 18);
    107108    ASSERT(MasqueradesAsUndefined == 1);
    108109    ASSERT(ImplementsHasInstance == 2);

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r153123 r153145  
    492492}
    493493
    494 LLINT_SLOW_PATH_DECL(slow_path_convert_this)
     494LLINT_SLOW_PATH_DECL(slow_path_to_this)
    495495{
    496496    LLINT_BEGIN();
    497497    JSValue v1 = LLINT_OP(1).jsValue();
    498     ASSERT(v1.isPrimitive());
    499498#if ENABLE(VALUE_PROFILER)
    500     pc[OPCODE_LENGTH(op_convert_this) - 1].u.profile->m_buckets[0] =
     499    pc[OPCODE_LENGTH(op_to_this) - 1].u.profile->m_buckets[0] =
    501500        JSValue::encode(v1.structureOrUndefined());
    502501#endif
    503     LLINT_RETURN(v1.toThisObject(exec));
     502    LLINT_RETURN(v1.toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
    504503}
    505504

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h

    r149418 r153145  
    119119LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_arguments);
    120120LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_create_this);
    121 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_convert_this);
     121LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to_this);
    122122LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_object);
    123123LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array);

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm

    r152209 r153145  
    101101const StringType = 5
    102102const ObjectType = 17
     103const FinalObjectType = 18
    103104
    104105# Type flags constants.

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r153104 r153145  
    397397
    398398
    399 _llint_op_convert_this:
    400     traceExecution()
    401     loadi 4[PC], t0
    402     bineq TagOffset[cfr, t0, 8], CellTag, .opConvertThisSlow
     399_llint_op_to_this:
     400    traceExecution()
     401    loadi 4[PC], t0
     402    bineq TagOffset[cfr, t0, 8], CellTag, .opToThisSlow
    403403    loadi PayloadOffset[cfr, t0, 8], t0
    404404    loadp JSCell::m_structure[t0], t0
    405     bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
     405    bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], FinalObjectType, .opToThisSlow
    406406    loadi 8[PC], t1
    407407    valueProfile(CellTag, t0, t1)
    408408    dispatch(3)
    409409
    410 .opConvertThisSlow:
    411     callSlowPath(_llint_slow_path_convert_this)
     410.opToThisSlow:
     411    callSlowPath(_llint_slow_path_to_this)
    412412    dispatch(3)
    413413

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r153104 r153145  
    280280
    281281
    282 _llint_op_convert_this:
     282_llint_op_to_this:
    283283    traceExecution()
    284284    loadisFromInstruction(1, t0)
    285285    loadq [cfr, t0, 8], t0
    286     btqnz t0, tagMask, .opConvertThisSlow
     286    btqnz t0, tagMask, .opToThisSlow
    287287    loadp JSCell::m_structure[t0], t0
    288     bbb Structure::m_typeInfo + TypeInfo::m_type[t0], ObjectType, .opConvertThisSlow
     288    bbneq Structure::m_typeInfo + TypeInfo::m_type[t0], FinalObjectType, .opToThisSlow
    289289    loadpFromInstruction(2, t1)
    290290    valueProfile(t0, t1)
    291291    dispatch(3)
    292292
    293 .opConvertThisSlow:
    294     callSlowPath(_llint_slow_path_convert_this)
     293.opToThisSlow:
     294    callSlowPath(_llint_slow_path_to_this)
    295295    dispatch(3)
    296296

  • trunk/Source/JavaScriptCore/profiler/ProfileGenerator.cpp

    r139541 r153145  
    6565
    6666    exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
    67     m_currentNode = ProfileNode::create(exec, LegacyProfiler::createCallIdentifier(exec, function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     67    m_currentNode = ProfileNode::create(exec, LegacyProfiler::createCallIdentifier(exec, function, sourceURL, lineNumber), m_head.get(), m_head.get());
    6868    m_head->insertNode(m_currentNode.get());
    6969}

  • trunk/Source/JavaScriptCore/runtime/CallData.cpp

    r139541 r153145  
    3737{
    3838    ASSERT(callType == CallTypeJS || callType == CallTypeHost);
    39     ASSERT(isValidThisObject(thisValue, exec));
    4039    return exec->interpreter()->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args);
    4140}

  • trunk/Source/JavaScriptCore/runtime/ClassInfo.h

    r134898 r153145  
    6767    GetOwnPropertySlotByIndexFunctionPtr getOwnPropertySlotByIndex;
    6868
    69     typedef JSObject* (*ToThisObjectFunctionPtr)(JSCell*, ExecState*);
    70     ToThisObjectFunctionPtr toThisObject;
     69    typedef JSValue (*ToThisFunctionPtr)(JSCell*, ExecState*, ECMAMode);
     70    ToThisFunctionPtr toThis;
    7171
    7272    typedef JSValue (*DefaultValueFunctionPtr)(const JSObject*, ExecState*, PreferredPrimitiveType);
    … …  
    129129        &ClassName::getOwnPropertySlot, \
    130130        &ClassName::getOwnPropertySlotByIndex, \
    131         &ClassName::toThisObject, \
     131        &ClassName::toThis, \
    132132        &ClassName::defaultValue, \
    133133        &ClassName::getOwnPropertyNames, \

  • trunk/Source/JavaScriptCore/runtime/Completion.cpp

    r149130 r153145  
    8080    if (!thisValue || thisValue.isUndefinedOrNull())
    8181        thisValue = exec->dynamicGlobalObject();
    82     JSObject* thisObj = thisValue.toThisObject(exec);
     82    JSObject* thisObj = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
    8383    JSValue result = exec->interpreter()->execute(program, exec, thisObj);
    8484

  • trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp

    r149980 r153145  
    11071107{
    11081108    JSValue thisValue = exec->hostThisValue();
    1109     JSObject* object = thisValue.toThisObject(exec);
     1109    JSObject* object = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
    11101110    if (exec->hadException())
    11111111        return JSValue::encode(jsNull());

  • trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp

    r139541 r153145  
    2424#include "GetterSetter.h"
    2525
     26#include "Error.h"
    2627#include "JSObject.h"
    2728#include "Operations.h"
    … …  
    4546}
    4647
     48JSValue callGetter(ExecState* exec, JSValue base, JSValue getterSetter)
     49{
     50    // FIXME: Some callers may invoke get() without checking for an exception first.
     51    // We work around that by checking here.
     52    if (exec->hadException())
     53        return exec->exception();
     54
     55    JSObject* getter = jsCast<GetterSetter*>(getterSetter)->getter();
     56    if (!getter)
     57        return jsUndefined();
     58
     59    CallData callData;
     60    CallType callType = getter->methodTable()->getCallData(getter, callData);
     61    return call(exec, getter, callType, callData, base, ArgList());
     62}
     63
     64void callSetter(ExecState* exec, JSValue base, JSValue getterSetter, JSValue value, ECMAMode ecmaMode)
     65{
     66    JSObject* setter = jsCast<GetterSetter*>(getterSetter)->setter();
     67    if (!setter) {
     68        if (ecmaMode == StrictMode)
     69            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
     70        return;
     71    }
     72
     73    MarkedArgumentBuffer args;
     74    args.append(value);
     75
     76    CallData callData;
     77    CallType callType = setter->methodTable()->getCallData(setter, callData);
     78    call(exec, setter, callType, callData, base, args);
     79}
     80
    4781} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/GetterSetter.h

    r148696 r153145  
    8080    }
    8181
     82    JSValue callGetter(ExecState*, JSValue base, JSValue getterSetter);
     83    void callSetter(ExecState*, JSValue base, JSValue getterSetter, JSValue value, ECMAMode);
    8284
    8385} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSActivation.cpp

    r153132 r153145  
    237237}
    238238
    239 JSObject* JSActivation::toThisObject(JSCell*, ExecState* exec)
    240 {
     239JSValue JSActivation::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
     240{
     241    if (ecmaMode == StrictMode)
     242        return jsUndefined();
    241243    return exec->globalThisValue();
    242244}

  • trunk/Source/JavaScriptCore/runtime/JSActivation.h

    r148696 r153145  
    7474        static bool deleteProperty(JSCell*, ExecState*, PropertyName);
    7575
    76         static JSObject* toThisObject(JSCell*, ExecState*);
     76        static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    7777
    7878        void tearOff(VM&);

  • trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp

    r148696 r153145  
    8181}
    8282
    83 JSObject* JSValue::toThisObjectSlowCase(ExecState* exec) const
     83JSValue JSValue::toThisSlowCase(ExecState* exec, ECMAMode ecmaMode) const
    8484{
    8585    ASSERT(!isCell());
     86
     87    if (ecmaMode == StrictMode)
     88        return *this;
    8689
    8790    if (isInt32() || isDouble())
    … …  
    148151            JSValue gs = obj->getDirect(offset);
    149152            if (gs.isGetterSetter()) {
    150                 JSObject* setterFunc = asGetterSetter(gs)->setter();       
    151                 if (!setterFunc) {
    152                     if (slot.isStrictMode())
    153                         throwError(exec, createTypeError(exec, ASCIILiteral("setting a property that has only a getter")));
    154                     return;
    155                 }
    156                
    157                 CallData callData;
    158                 CallType callType = setterFunc->methodTable()->getCallData(setterFunc, callData);
    159                 MarkedArgumentBuffer args;
    160                 args.append(value);
    161 
    162                 // If this is WebCore's global object then we need to substitute the shell.
    163                 call(exec, setterFunc, callType, callData, *this, args);
     153                callSetter(exec, *this, gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode);
    164154                return;
    165155            }

  • trunk/Source/JavaScriptCore/runtime/JSCJSValue.h

    r152613 r153145  
    7373
    7474enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
    75 
     75enum ECMAMode { StrictMode, NotStrictMode };
    7676
    7777typedef int64_t EncodedJSValue;
    … …  
    246246    void putByIndex(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
    247247
    248     JSObject* toThisObject(ExecState*) const;
     248    JSValue toThis(ExecState*, ECMAMode) const;
    249249
    250250    static bool equal(ExecState*, JSValue v1, JSValue v2);
    … …  
    276276    JS_EXPORT_PRIVATE WTF::String toWTFStringSlowCase(ExecState*) const;
    277277    JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
    278     JS_EXPORT_PRIVATE JSObject* toThisObjectSlowCase(ExecState*) const;
     278    JS_EXPORT_PRIVATE JSValue toThisSlowCase(ExecState*, ECMAMode) const;
    279279
    280280#if USE(JSVALUE32_64)

  • trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h

    r150659 r153145  
    615615}
    616616
    617 inline JSObject* JSValue::toThisObject(ExecState* exec) const
    618 {
    619     return isCell() ? asCell()->methodTable()->toThisObject(asCell(), exec) : toThisObjectSlowCase(exec);
     617inline JSValue JSValue::toThis(ExecState* exec, ECMAMode ecmaMode) const
     618{
     619    return isCell() ? asCell()->methodTable()->toThis(asCell(), exec, ecmaMode) : toThisSlowCase(exec, ecmaMode);
    620620}
    621621

  • trunk/Source/JavaScriptCore/runtime/JSCell.cpp

    r152573 r153145  
    140140}
    141141
    142 JSObject* JSCell::toThisObject(JSCell* cell, ExecState* exec)
    143 {
     142JSValue JSCell::toThis(JSCell* cell, ExecState* exec, ECMAMode ecmaMode)
     143{
     144    if (ecmaMode == StrictMode)
     145        return cell;
    144146    return cell->toObject(exec, exec->lexicalGlobalObject());
    145147}

  • trunk/Source/JavaScriptCore/runtime/JSCell.h

    r149236 r153145  
    114114    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
    115115
    116     static JSObject* toThisObject(JSCell*, ExecState*);
     116    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    117117
    118118    void zap() { *reinterpret_cast<uintptr_t**>(this) = 0; }

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r151605 r153145  
    530530}
    531531
    532 JSObject* JSGlobalObject::toThisObject(JSCell* cell, ExecState*)
    533 {
    534     return jsCast<JSGlobalObject*>(cell)->globalThis();
     532JSValue JSGlobalObject::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
     533{
     534    if (ecmaMode == StrictMode)
     535        return jsUndefined();
     536    return exec->globalThisValue();
    535537}
    536538

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r149836 r153145  
    385385    VM& vm() const { return *Heap::heap(this)->vm(); }
    386386    JSObject* globalThis() const;
     387    JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
    387388
    388389    static Structure* createStructure(VM& vm, JSValue prototype)
    … …  
    433434    JS_EXPORT_PRIVATE void addStaticGlobals(GlobalPropertyInfo*, int count);
    434435
    435     JS_EXPORT_PRIVATE static JSC::JSObject* toThisObject(JSC::JSCell*, JSC::ExecState*);
    436 
    437     JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
     436    JS_EXPORT_PRIVATE static JSC::JSValue toThis(JSC::JSCell*, JSC::ExecState*, ECMAMode);
    438437
    439438private:

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

    r153135 r153145  
    708708EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState* exec)
    709709{
    710     if (!exec->thisValue().isObject())
     710    JSObject* thisObject = jsDynamicCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode));
     711
     712    if (!thisObject)
    711713        return JSValue::encode(exec->thisValue().synthesizePrototype(exec));
    712714
    713     JSObject* thisObject = asObject(exec->thisValue());
    714715    if (!thisObject->allowsAccessFrom(exec->trueCallerFrame()))
    715716        return JSValue::encode(jsUndefined());
    … …  
    722723    JSValue value = exec->argument(0);
    723724
     725    JSObject* thisObject = jsDynamicCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode));
     726
    724727    // Setting __proto__ of a primitive should have no effect.
    725     if (!exec->thisValue().isObject())
     728    if (!thisObject)
    726729        return JSValue::encode(jsUndefined());
    727730
    728     JSObject* thisObject = asObject(exec->thisValue());
    729731    if (!thisObject->allowsAccessFrom(exec->trueCallerFrame()))
    730732        return JSValue::encode(jsUndefined());
    … …  
    737739        return throwVMError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
    738740
    739     if (!thisObject->setPrototypeWithCycleCheck(exec->vm(), value))
     741    if (!thisObject->setPrototypeWithCycleCheck(exec, value))
    740742        throwError(exec, createError(exec, "cyclic __proto__ value"));
    741743    return JSValue::encode(jsUndefined());

  • trunk/Source/JavaScriptCore/runtime/JSNameScope.cpp

    r140594 r153145  
    4545}
    4646
    47 JSObject* JSNameScope::toThisObject(JSCell*, ExecState* exec)
     47JSValue JSNameScope::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
    4848{
     49    if (ecmaMode == StrictMode)
     50        return jsUndefined();
    4951    return exec->globalThisValue();
    5052}

  • trunk/Source/JavaScriptCore/runtime/JSNameScope.h

    r148696 r153145  
    5353    static void visitChildren(JSCell*, SlotVisitor&);
    5454    bool isDynamicScope(bool& requiresDynamicChecks) const;
    55     static JSObject* toThisObject(JSCell*, ExecState*);
     55    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    5656    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
    5757    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r152784 r153145  
    383383            JSValue gs = obj->getDirect(offset);
    384384            if (gs.isGetterSetter()) {
    385                 ASSERT(attributes & Accessor);
    386                 ASSERT(thisObject->structure()->prototypeChainMayInterceptStoreTo(exec->vm(), propertyName) || obj == thisObject);
    387                 JSObject* setterFunc = asGetterSetter(gs)->setter();       
    388                 if (!setterFunc) {
    389                     if (slot.isStrictMode())
    390                         throwError(exec, createTypeError(exec, ASCIILiteral("setting a property that has only a getter")));
    391                     return;
    392                 }
    393                
    394                 CallData callData;
    395                 CallType callType = setterFunc->methodTable()->getCallData(setterFunc, callData);
    396                 MarkedArgumentBuffer args;
    397                 args.append(value);
    398 
    399                 // If this is WebCore's global object then we need to substitute the shell.
    400                 call(exec, setterFunc, callType, callData, thisObject->methodTable()->toThisObject(thisObject, exec), args);
     385                callSetter(exec, cell, gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode);
    401386                return;
    402387            } else
    … …  
    11731158}
    11741159
    1175 bool JSObject::setPrototypeWithCycleCheck(VM& vm, JSValue prototype)
    1176 {
    1177     JSValue checkFor = this;
    1178     if (this->isGlobalObject())
    1179         checkFor = jsCast<JSGlobalObject*>(this)->globalExec()->thisValue();
    1180 
     1160bool JSObject::setPrototypeWithCycleCheck(ExecState* exec, JSValue prototype)
     1161{
     1162    ASSERT(methodTable()->toThis(this, exec, NotStrictMode) == this);
    11811163    JSValue nextPrototype = prototype;
    11821164    while (nextPrototype && nextPrototype.isObject()) {
    1183         if (nextPrototype == checkFor)
     1165        if (nextPrototype == this)
    11841166            return false;
    11851167        nextPrototype = asObject(nextPrototype)->prototype();
    11861168    }
    1187     setPrototype(vm, prototype);
     1169    setPrototype(exec->vm(), prototype);
    11881170    return true;
    11891171}
    … …  
    15611543}
    15621544
    1563 JSObject* JSObject::toThisObject(JSCell* cell, ExecState*)
     1545JSValue JSObject::toThis(JSCell* cell, ExecState*, ECMAMode)
    15641546{
    15651547    return jsCast<JSObject*>(cell);
    … …  
    16411623}
    16421624
    1643 NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, PropertyOffset offset)
    1644 {
    1645     if (JSObject* getterFunction = asGetterSetter(getDirect(offset))->getter()) {
    1646         if (!structure()->isDictionary())
    1647             slot.setCacheableGetterSlot(this, getterFunction, offset);
    1648         else
    1649             slot.setGetterSlot(getterFunction);
    1650     } else
    1651         slot.setUndefined();
     1625NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue getterSetter, PropertyOffset offset)
     1626{
     1627    if (structure()->isDictionary()) {
     1628        slot.setGetterSlot(jsCast<GetterSetter*>(getterSetter));
     1629        return;
     1630    }
     1631
     1632    slot.setCacheableGetterSlot(this, jsCast<GetterSetter*>(getterSetter), offset);
    16521633}
    16531634

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r151605 r153145  
    123123    JSValue prototype() const;
    124124    void setPrototype(VM&, JSValue prototype);
    125     bool setPrototypeWithCycleCheck(VM&, JSValue prototype);
     125    bool setPrototypeWithCycleCheck(ExecState*, JSValue prototype);
    126126       
    127127    bool mayInterceptIndexedAccesses()
    … …  
    487487    JS_EXPORT_PRIVATE JSString* toString(ExecState*) const;
    488488
    489     // NOTE: JSObject and its subclasses must be able to gracefully handle ExecState* = 0,
    490     // because this call may come from inside the compiler.
    491     JS_EXPORT_PRIVATE static JSObject* toThisObject(JSCell*, ExecState*);
     489    JS_EXPORT_PRIVATE static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    492490
    493491    bool getPropertySpecificValue(ExecState*, PropertyName, JSCell*& specificFunction) const;
    … …  
    926924
    927925    bool inlineGetOwnPropertySlot(ExecState*, PropertyName, PropertySlot&);
    928     JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, PropertyOffset);
     926    JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, JSValue, PropertyOffset);
    929927
    930928    const HashEntry* findPropertyHashEntry(ExecState*, PropertyName) const;
    … …  
    11611159        JSValue value = getDirect(offset);
    11621160        if (structure()->hasGetterSetterProperties() && value.isGetterSetter())
    1163             fillGetterPropertySlot(slot, offset);
     1161            fillGetterPropertySlot(slot, value, offset);
    11641162        else
    11651163            slot.setValue(this, value, offset);

  • trunk/Source/JavaScriptCore/runtime/JSScope.cpp

    r153123 r153145  
    537537            return JSValue();
    538538        ASSERT(value);
    539         *base = propertyBase->structure()->typeInfo().isEnvironmentRecord() ? jsUndefined() : JSValue(propertyBase);
     539        *base = JSValue(propertyBase);
    540540        return value;
    541541    }

  • trunk/Source/JavaScriptCore/runtime/JSString.cpp

    r148696 r153145  
    272272}
    273273
    274 JSObject* JSString::toThisObject(JSCell* cell, ExecState* exec)
    275 {
     274JSValue JSString::toThis(JSCell* cell, ExecState* exec, ECMAMode ecmaMode)
     275{
     276    if (ecmaMode == StrictMode)
     277        return cell;
    276278    return StringObject::create(exec, exec->lexicalGlobalObject(), jsCast<JSString*>(cell));
    277279}

  • trunk/Source/JavaScriptCore/runtime/JSString.h

    r152613 r153145  
    201201    friend class LLIntOffsetsExtractor;
    202202       
    203     static JSObject* toThisObject(JSCell*, ExecState*);
     203    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    204204
    205205    // Actually getPropertySlot, not getOwnPropertySlot (see JSCell).

  • trunk/Source/JavaScriptCore/runtime/PropertySlot.cpp

    r139541 r153145  
    2222#include "PropertySlot.h"
    2323
    24 #include "JSFunction.h"
    25 #include "JSGlobalObject.h"
    26 #include "Operations.h"
     24#include "GetterSetter.h"
     25#include "JSCJSValueInlines.h"
    2726
    2827namespace JSC {
    … …  
    3029JSValue PropertySlot::functionGetter(ExecState* exec) const
    3130{
    32     // Prevent getter functions from observing execution if an exception is pending.
    33     if (exec->hadException())
    34         return exec->exception();
    35 
    36     CallData callData;
    37     CallType callType = m_data.getterFunc->methodTable()->getCallData(m_data.getterFunc, callData);
    38     return call(exec, m_data.getterFunc, callType, callData, m_thisValue.isObject() ? m_thisValue.toThisObject(exec) : m_thisValue, exec->emptyList());
     31    return callGetter(exec, m_thisValue, m_data.getterSetter);
    3932}
    4033

  • trunk/Source/JavaScriptCore/runtime/PropertySlot.h

    r140718 r153145  
    3232
    3333    class ExecState;
    34     class JSObject;
     34    class GetterSetter;
    3535
    3636#define JSC_VALUE_MARKER 0
    … …  
    154154        }
    155155
    156         void setGetterSlot(JSObject* getterFunc)
    157         {
    158             ASSERT(getterFunc);
     156        void setGetterSlot(GetterSetter* getterSetter)
     157        {
     158            ASSERT(getterSetter);
    159159            m_thisValue = m_slotBase;
    160160            m_getValue = GETTER_FUNCTION_MARKER;
    161             m_data.getterFunc = getterFunc;
    162         }
    163 
    164         void setCacheableGetterSlot(JSValue slotBase, JSObject* getterFunc, PropertyOffset offset)
    165         {
    166             ASSERT(getterFunc);
     161            m_data.getterSetter = getterSetter;
     162        }
     163
     164        void setCacheableGetterSlot(JSValue slotBase, GetterSetter* getterSetter, PropertyOffset offset)
     165        {
     166            ASSERT(getterSetter);
    167167            m_getValue = GETTER_FUNCTION_MARKER;
    168168            m_thisValue = m_slotBase;
    169169            m_slotBase = slotBase;
    170             m_data.getterFunc = getterFunc;
     170            m_data.getterSetter = getterSetter;
    171171            m_offset = offset;
    172172            m_cachedPropertyType = Getter;
    … …  
    227227        JSValue m_slotBase;
    228228        union {
    229             JSObject* getterFunc;
     229            GetterSetter* getterSetter;
    230230            unsigned index;
    231231        } m_data;

  • trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp

    r148696 r153145  
    133133    }
    134134
    135     JSObject* getter = asGetterSetter(value)->getter();
    136     if (!getter) {
    137         slot.setUndefined();
    138         return;
    139     }
    140 
    141     slot.setGetterSlot(getter);
     135    slot.setGetterSlot(jsCast<GetterSetter*>(value));
    142136}
    143137
    … …  
    149143JSValue SparseArrayEntry::get(ExecState* exec, JSObject* array) const
    150144{
    151     JSValue result = Base::get();
    152     ASSERT(result);
     145    JSValue value = Base::get();
     146    ASSERT(value);
    153147
    154     if (LIKELY(!result.isGetterSetter()))
    155         return result;
     148    if (LIKELY(!value.isGetterSetter()))
     149        return value;
    156150
    157     JSObject* getter = asGetterSetter(result)->getter();
    158     if (!getter)
    159         return jsUndefined();
    160 
    161     CallData callData;
    162     CallType callType = getter->methodTable()->getCallData(getter, callData);
    163     return call(exec, getter, callType, callData, array->methodTable()->toThisObject(array, exec), exec->emptyList());
     151    return callGetter(exec, array, jsCast<GetterSetter*>(value));
    164152}
    165153
    … …  
    177165    }
    178166
    179     JSValue accessor = Base::get();
    180     ASSERT(accessor.isGetterSetter());
    181     JSObject* setter = asGetterSetter(accessor)->setter();
    182    
    183     if (!setter) {
    184         if (shouldThrow)
    185             throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
    186         return;
    187     }
    188 
    189     CallData callData;
    190     CallType callType = setter->methodTable()->getCallData(setter, callData);
    191     MarkedArgumentBuffer args;
    192     args.append(value);
    193     if (thisValue.isObject())
    194         thisValue = asObject(thisValue)->methodTable()->toThisObject(asObject(thisValue), exec);
    195     call(exec, setter, callType, callData, thisValue, args);
     167    callSetter(exec, thisValue, Base::get(), value, shouldThrow ? StrictMode : NotStrictMode);
    196168}
    197169

  • trunk/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp

    r148696 r153145  
    5050}
    5151
    52 JSObject* StrictEvalActivation::toThisObject(JSCell*, ExecState* exec)
     52JSValue StrictEvalActivation::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
    5353{
     54    if (ecmaMode == StrictMode)
     55        return jsUndefined();
    5456    return exec->globalThisValue();
    5557}

  • trunk/Source/JavaScriptCore/runtime/StrictEvalActivation.h

    r148696 r153145  
    4343
    4444    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
    45     static JSObject* toThisObject(JSCell*, ExecState*);
     45    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
    4646
    4747    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

  • trunk/Source/WebCore/ChangeLog

    r153135 r153145  
     12013-05-05  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rolled back in r149527 with crash fixed.
     4
     5        Reviewed by Oliver Hunt.
     6
     7            Rationalized 'this' value conversion
     8            https://bugs.webkit.org/show_bug.cgi?id=115542
     9
    1102013-04-29  Filip Pizlo  <fpizlo@apple.com>
    211

  • trunk/Source/WebCore/WebCore.order

    r152685 r153145  
    28022802__ZN7WebCore13ScriptElement13executeScriptERKNS_16ScriptSourceCodeE
    28032803__ZNK7WebCore21ContentSecurityPolicy17allowInlineScriptEv
    2804 __ZNK7WebCore15JSDOMWindowBase12toThisObjectEPN3JSC9ExecStateE
    28052804__ZN7WebCore16JSDOMWindowShell18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
    28062805__ZN7WebCore16JSDOMWindowShell17putWithAttributesEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueEj

  • trunk/Source/WebCore/bindings/js/JSErrorHandler.cpp

    r148696 r153145  
    9393        DynamicGlobalObjectScope globalObjectScope(vm, vm.dynamicGlobalObject ? vm.dynamicGlobalObject : globalObject);
    9494
    95         JSValue thisValue = globalObject->methodTable()->toThisObject(globalObject, exec);
    96 
    9795        JSValue returnValue = scriptExecutionContext->isDocument()
    98             ? JSMainThreadExecState::call(exec, jsFunction, callType, callData, thisValue, args)
    99             : JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     96            ? JSMainThreadExecState::call(exec, jsFunction, callType, callData, globalObject, args)
     97            : JSC::call(exec, jsFunction, callType, callData, globalObject, args);
    10098
    10199        globalObject->setCurrentEvent(savedEvent);

  • trunk/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp

    r148696 r153145  
    113113        return jsUndefined();
    114114
    115     JSObject* thisObject = exec->argument(0).toThisObject(exec);
     115    JSObject* thisObject = jsCast<JSObject*>(exec->argument(0).toThis(exec, NotStrictMode));
    116116    String result = thisObject->methodTable()->className(thisObject);
    117117    return jsStringWithCache(exec, result);

  • trunk/Source/WebCore/bindings/js/JSMainThreadExecState.h

    r130021 r153145  
    5151    {
    5252        JSMainThreadExecState currentState(exec);
    53         // Ensure DOM global object is unwrapped to the shell.
    54         if (thisValue.isObject())
    55             thisValue = thisValue.toThisObject(exec);
    5653        return JSC::call(exec, functionObject, callType, callData, thisValue, args);
    5754    };

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r152844 r153145  
    24982498            } else {
    24992499                if ($interfaceName eq "DOMWindow") {
    2500                     push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThisObject(exec));\n");
     2500                    push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThis(exec, NotStrictMode));\n");
    25012501                    push(@implContent, "    if (!castedThis)\n");
    25022502                    push(@implContent, "        return throwVMTypeError(exec);\n");
    2503                 } elsif ($codeGenerator->InheritsInterface($interface, "WorkerGlobalScope")) {
    2504                     push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThisObject(exec));\n");
     2503                } elsif ($interface->extendedAttributes->{"WorkerGlobalScope"}) {
     2504                    push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThis(exec, NotStrictMode));\n");
    25052505                    push(@implContent, "    if (!castedThis)\n");
    25062506                    push(@implContent, "        return throwVMTypeError(exec);\n");

  • trunk/Source/WebCore/bridge/NP_jsobject.cpp

    r130612 r153145  
    235235        MarkedArgumentBuffer argList;
    236236        getListFromVariantArgs(exec, args, argCount, rootObject, argList);
    237         JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp->methodTable()->toThisObject(obj->imp, exec), argList);
     237        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
    238238
    239239        // Convert and return the result of the function call.

  • trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp

    r153017 r153145  
    398398        return;
    399399
    400     JSC::JSObject* thisObj = globalObject->methodTable()->toThisObject(globalObject, exec);
    401 
    402     JSC::call(exec, overlay, callType, callData, thisObj, argList);
     400    JSC::call(exec, overlay, callType, callData, globalObject, argList);
    403401}
    404402

  • trunk/Source/WebKit/mac/ChangeLog

    r152814 r153145  
     12013-05-05  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rolled back in r149527 with crash fixed.
     4
     5        Reviewed by Oliver Hunt.
     6
     7            Rationalized 'this' value conversion
     8            https://bugs.webkit.org/show_bug.cgi?id=115542
     9
    1102013-07-17  Commit Queue  <commit-queue@webkit.org>
    211

  • trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm

    r152238 r153145  
    912912    demarshalValues(exec, argumentsData, argumentsLength, argList);
    913913
    914     JSValue value = call(exec, function, callType, callData, object->methodTable()->toThisObject(object, exec), argList);
     914    JSValue value = call(exec, function, callType, callData, object, argList);
    915915       
    916916    marshalValue(exec, value, resultData, resultLength);
    … …  
    944944    demarshalValues(exec, argumentsData, argumentsLength, argList);
    945945
    946     JSValue value = call(exec, object, callType, callData, object->methodTable()->toThisObject(object, exec), argList);
     946    JSValue value = call(exec, object, callType, callData, object, argList);
    947947   
    948948    marshalValue(exec, value, resultData, resultLength);

  • trunk/Source/WebKit2/ChangeLog

    r153108 r153145  
     12013-05-05  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Rolled back in r149527 with crash fixed.
     4
     5        Reviewed by Oliver Hunt.
     6
     7            Rationalized 'this' value conversion
     8            https://bugs.webkit.org/show_bug.cgi?id=115542
     9
    1102013-07-24  Ruth Fong  <ruth_fong@apple.com>
    211

  • trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp

    r148696 r153145  
    294294        argumentList.append(m_objectMap->convertNPVariantToJSValue(exec, globalObject, arguments[i]));
    295295
    296     JSValue value = JSC::call(exec, function, callType, callData, m_jsObject->methodTable()->toThisObject(m_jsObject.get(), exec), argumentList);
     296    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject.get(), argumentList);
    297297
    298298    // Convert and return the result of the function call.
Note: See TracChangeset for help on using the changeset viewer.