Changeset 172794 in webkit


Ignore:
Timestamp:
Aug 19, 2014 7:38:46 PM (10 years ago)
Author:
fpizlo@apple.com
Message:

REGRESSION(r172401): for-in optimization no longer works at all
​https://bugs.webkit.org/show_bug.cgi?id=136056

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Roll this back in, along with a fix to make proxies work. Previously, for-in over proxies
would instacrash every time.

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitGetByVal):
(JSC::BytecodeGenerator::pushIndexedForInScope):
(JSC::BytecodeGenerator::pushStructureForInScope):

  • bytecompiler/BytecodeGenerator.h:

(JSC::ForInContext::ForInContext):
(JSC::StructureForInContext::StructureForInContext):
(JSC::IndexedForInContext::IndexedForInContext):
(JSC::ForInContext::base): Deleted.

  • bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitMultiLoopBytecode):

  • runtime/JSProxy.cpp:

(JSC::JSProxy::getStructurePropertyNames):
(JSC::JSProxy::getGenericPropertyNames):

  • tests/stress/for-in-base-reassigned-later-and-change-structure.js: Added.

(foo):

  • tests/stress/for-in-base-reassigned-later.js: Added.

(foo):

  • tests/stress/for-in-base-reassigned.js: Added.

(foo):

  • tests/stress/for-in-proxy-target-changed-structure.js: Added.

(deleteAll):
(foo):

  • tests/stress/for-in-proxy.js: Added.

(foo):

LayoutTests:

This just needs a rebase because the number of calls into the DOM has changed and so the
number of console messages about security stuff has now changed.

  • http/tests/security/cross-frame-access-enumeration-expected.txt:
Location:
trunk
Files:
5 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r172757 r172794  
     12014-08-19  Filip Pizlo  <fpizlo@apple.com>
     2
     3        REGRESSION(r172401): for-in optimization no longer works at all
     4        https://bugs.webkit.org/show_bug.cgi?id=136056
     5
     6        Reviewed by Geoffrey Garen.
     7       
     8        This just needs a rebase because the number of calls into the DOM has changed and so the
     9        number of console messages about security stuff has now changed.
     10
     11        * http/tests/security/cross-frame-access-enumeration-expected.txt:
     12
    1132014-08-19  Bem Jones-Bey  <bjonesbe@adobe.com>
    214

  • trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt

    r172264 r172794  
    1 CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    21CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
    32CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.

  • trunk/Source/JavaScriptCore/ChangeLog

    r172793 r172794  
     12014-08-19  Filip Pizlo  <fpizlo@apple.com>
     2
     3        REGRESSION(r172401): for-in optimization no longer works at all
     4        https://bugs.webkit.org/show_bug.cgi?id=136056
     5
     6        Reviewed by Geoffrey Garen.
     7       
     8        Roll this back in, along with a fix to make proxies work. Previously, for-in over proxies
     9        would instacrash every time.
     10
     11        * bytecompiler/BytecodeGenerator.cpp:
     12        (JSC::BytecodeGenerator::emitGetByVal):
     13        (JSC::BytecodeGenerator::pushIndexedForInScope):
     14        (JSC::BytecodeGenerator::pushStructureForInScope):
     15        * bytecompiler/BytecodeGenerator.h:
     16        (JSC::ForInContext::ForInContext):
     17        (JSC::StructureForInContext::StructureForInContext):
     18        (JSC::IndexedForInContext::IndexedForInContext):
     19        (JSC::ForInContext::base): Deleted.
     20        * bytecompiler/NodesCodegen.cpp:
     21        (JSC::ForInNode::emitMultiLoopBytecode):
     22        * runtime/JSProxy.cpp:
     23        (JSC::JSProxy::getStructurePropertyNames):
     24        (JSC::JSProxy::getGenericPropertyNames):
     25        * tests/stress/for-in-base-reassigned-later-and-change-structure.js: Added.
     26        (foo):
     27        * tests/stress/for-in-base-reassigned-later.js: Added.
     28        (foo):
     29        * tests/stress/for-in-base-reassigned.js: Added.
     30        (foo):
     31        * tests/stress/for-in-proxy-target-changed-structure.js: Added.
     32        (deleteAll):
     33        (foo):
     34        * tests/stress/for-in-proxy.js: Added.
     35        (foo):
     36
    1372014-08-19  Jaehun Lim  <ljaehun.lim@samsung.com>
    238

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r172742 r172794  
    14231423    for (size_t i = m_forInContextStack.size(); i > 0; i--) {
    14241424        ForInContext* context = m_forInContextStack[i - 1].get();
    1425         if (context->base() != base)
    1426             continue;
    1427 
    14281425        if (context->local() != property)
    14291426            continue;
    … …  
    25872584}
    25882585
    2589 void BytecodeGenerator::pushIndexedForInScope(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister)
     2586void BytecodeGenerator::pushIndexedForInScope(RegisterID* localRegister, RegisterID* indexRegister)
    25902587{
    25912588    if (!localRegister)
    25922589        return;
    2593     m_forInContextStack.append(std::make_unique<IndexedForInContext>(baseRegister, localRegister, indexRegister));
     2590    m_forInContextStack.append(std::make_unique<IndexedForInContext>(localRegister, indexRegister));
    25942591}
    25952592
    … …  
    26012598}
    26022599
    2603 void BytecodeGenerator::pushStructureForInScope(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
     2600void BytecodeGenerator::pushStructureForInScope(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
    26042601{
    26052602    if (!localRegister)
    26062603        return;
    2607     m_forInContextStack.append(std::make_unique<StructureForInContext>(baseRegister, localRegister, indexRegister, propertyRegister, enumeratorRegister));
     2604    m_forInContextStack.append(std::make_unique<StructureForInContext>(localRegister, indexRegister, propertyRegister, enumeratorRegister));
    26082605}
    26092606

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

    r172742 r172794  
    100100    class ForInContext {
    101101    public:
    102         ForInContext(RegisterID* baseRegister, RegisterID* localRegister)
    103             : m_baseRegister(baseRegister)
    104             , m_localRegister(localRegister)
     102        ForInContext(RegisterID* localRegister)
     103            : m_localRegister(localRegister)
    105104            , m_isValid(true)
    106105        {
    … …  
    120119        virtual ForInContextType type() const = 0;
    121120
    122         RegisterID* base() const { return m_baseRegister.get(); }
    123121        RegisterID* local() const { return m_localRegister.get(); }
    124122
    125123    private:
    126         RefPtr<RegisterID> m_baseRegister;
    127124        RefPtr<RegisterID> m_localRegister;
    128125        bool m_isValid;
    … …  
    131128    class StructureForInContext : public ForInContext {
    132129    public:
    133         StructureForInContext(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
    134             : ForInContext(baseRegister, localRegister)
     130        StructureForInContext(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
     131            : ForInContext(localRegister)
    135132            , m_indexRegister(indexRegister)
    136133            , m_propertyRegister(propertyRegister)
    … …  
    156153    class IndexedForInContext : public ForInContext {
    157154    public:
    158         IndexedForInContext(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister)
    159             : ForInContext(baseRegister, localRegister)
     155        IndexedForInContext(RegisterID* localRegister, RegisterID* indexRegister)
     156            : ForInContext(localRegister)
    160157            , m_indexRegister(indexRegister)
    161158        {
    … …  
    528525        void popFinallyContext();
    529526
    530         void pushIndexedForInScope(RegisterID* base, RegisterID* local, RegisterID* index);
     527        void pushIndexedForInScope(RegisterID* local, RegisterID* index);
    531528        void popIndexedForInScope(RegisterID* local);
    532         void pushStructureForInScope(RegisterID* base, RegisterID* local, RegisterID* index, RegisterID* property, RegisterID* enumerator);
     529        void pushStructureForInScope(RegisterID* local, RegisterID* index, RegisterID* property, RegisterID* enumerator);
    533530        void popStructureForInScope(RegisterID* local);
    534531        void invalidateForInContextForLocal(RegisterID* local);

  • trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

    r172742 r172794  
    20712071        this->emitLoopHeader(generator, propertyName.get());
    20722072
    2073         generator.pushIndexedForInScope(base.get(), local.get(), i.get());
     2073        generator.pushIndexedForInScope(local.get(), i.get());
    20742074        generator.emitNode(dst, m_statement);
    20752075        generator.popIndexedForInScope(local.get());
    … …  
    21052105        this->emitLoopHeader(generator, propertyName.get());
    21062106
    2107         generator.pushStructureForInScope(base.get(), local.get(), i.get(), propertyName.get(), structureEnumerator.get());
     2107        generator.pushStructureForInScope(local.get(), i.get(), propertyName.get(), structureEnumerator.get());
    21082108        generator.emitNode(dst, m_statement);
    21092109        generator.popStructureForInScope(local.get());

  • trunk/Source/JavaScriptCore/runtime/JSProxy.cpp

    r172176 r172794  
    121121}
    122122
    123 void JSProxy::getStructurePropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
     123void JSProxy::getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
    124124{
    125     JSProxy* thisObject = jsCast<JSProxy*>(object);
    126     thisObject->target()->methodTable(exec->vm())->getStructurePropertyNames(thisObject->target(), exec, propertyNames, mode);
     125    // Skip the structure loop, since it is invalid for proxies.
    127126}
    128127
    … …  
    130129{
    131130    JSProxy* thisObject = jsCast<JSProxy*>(object);
    132     thisObject->target()->methodTable(exec->vm())->getGenericPropertyNames(thisObject->target(), exec, propertyNames, mode);
     131    // Get *all* of the property names, not just the generic ones, since we skipped the structure
     132    // ones above.
     133    thisObject->target()->methodTable(exec->vm())->getPropertyNames(thisObject->target(), exec, propertyNames, mode);
    133134}
    134135
Note: See TracChangeset for help on using the changeset viewer.