Changeset 44016 in webkit

Timestamp:

May 21, 2009 5:28:22 PM (15 years ago)

Author:

oliver@apple.com

Message:

<rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
<​https://bugs.webkit.org/show_bug.cgi?id=25921>

Reviewed by Maciej Stachowiak.

When caching properties on the global object we need to ensure that we're
not attempting to cache through a shell object.

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)
• JavaScriptCore/jit/JITStubs.cpp (modified) (1 diff)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/global-function-resolve-expected.txt (added)
• LayoutTests/fast/js/global-function-resolve.html (added)
• LayoutTests/fast/js/resources/global-function-resolve.js (added)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
+        <https://bugs.webkit.org/show_bug.cgi?id=25921>
+
+        When caching properties on the global object we need to ensure that we're
+        not attempting to cache through a shell object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global):
+
 2009-05-21  Steve Falkenburg  <sfalken@apple.com>
 

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -172 +172 @@
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();

trunk/JavaScriptCore/jit/JITStubs.cpp

@@ -1734 +1734 @@
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add tests to ensure that we correctly cache (or do not cache) lookups
+        of global properties.
+
+        * fast/js/global-function-resolve.html: Added.
+        * fast/js/resources/global-function-resolve.js: Added.
+
 2009-05-21  Geoffrey Garen  <ggaren@apple.com>