Changeset 53341 in webkit


Ignore:
Timestamp:
Jan 15, 2010 12:48:52 PM (14 years ago)
Author:
ggaren@apple.com
Message:

2010-01-14 Geoffrey Garen <​ggaren@apple.com>

Reviewed by Oliver Hunt.

REGRESISON: Google maps buttons not working properly
​https://bugs.webkit.org/show_bug.cgi?id=31871

REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
getting directions for a second time
​https://bugs.webkit.org/show_bug.cgi?id=33446


SunSpider and v8 report no change.

  • interpreter/Interpreter.cpp: (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case flattening the dictionary changed any of its offsets.
  • jit/JITStubs.cpp: (JSC::JITThunks::tryCacheGetByID): (JSC::DEFINE_STUB_FUNCTION):
  • runtime/Operations.h: (JSC::normalizePrototypeChain): ditto

2010-01-15 Geoffrey Garen <​ggaren@apple.com>

Reviewed by Oliver Hunt.

REGRESISON: Google maps buttons not working properly
​https://bugs.webkit.org/show_bug.cgi?id=31871

REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
getting directions for a second time
​https://bugs.webkit.org/show_bug.cgi?id=33446


Added a test for these bugs.

  • fast/js/pic/undictionary-expected.txt: Added.
  • fast/js/pic/undictionary.html: Added.
Location:
trunk
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/ChangeLog

    r53323 r53341  
     12010-01-14  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        REGRESISON: Google maps buttons not working properly
     6        https://bugs.webkit.org/show_bug.cgi?id=31871
     7
     8        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
     9        getting directions for a second time
     10        https://bugs.webkit.org/show_bug.cgi?id=33446
     11       
     12        SunSpider and v8 report no change.
     13
     14        * interpreter/Interpreter.cpp:
     15        (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case
     16        flattening the dictionary changed any of its offsets.
     17
     18        * jit/JITStubs.cpp:
     19        (JSC::JITThunks::tryCacheGetByID):
     20        (JSC::DEFINE_STUB_FUNCTION):
     21        * runtime/Operations.h:
     22        (JSC::normalizePrototypeChain): ditto
     23
    1242010-01-14  Gavin Barraclough  <barraclough@apple.com>
    225

  • trunk/JavaScriptCore/interpreter/Interpreter.cpp

    r52231 r53341  
    10451045
    10461046        JSObject* baseObject = asObject(slot.slotBase());
     1047        size_t offset = slot.cachedOffset();
    10471048
    10481049        // Since we're accessing a prototype in a loop, it's a good bet that it
    10491050        // should not be treated as a dictionary.
    1050         if (baseObject->structure()->isDictionary())
     1051        if (baseObject->structure()->isDictionary()) {
    10511052            baseObject->flattenDictionaryObject();
     1053            offset = baseObject->structure()->get(propertyName);
     1054        }
    10521055
    10531056        ASSERT(!baseObject->structure()->isUncacheableDictionary());
    … …  
    10551058        vPC[0] = getOpcode(op_get_by_id_proto);
    10561059        vPC[5] = baseObject->structure();
    1057         vPC[6] = slot.cachedOffset();
     1060        vPC[6] = offset;
    10581061
    10591062        codeBlock->refStructures(vPC);
    … …  
    10611064    }
    10621065
    1063     size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     1066    size_t offset = slot.cachedOffset();
     1067    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
    10641068    if (!count) {
    10651069        vPC[0] = getOpcode(op_get_by_id_generic);
    … …  
    10711075    vPC[5] = structure->prototypeChain(callFrame);
    10721076    vPC[6] = count;
    1073     vPC[7] = slot.cachedOffset();
     1077    vPC[7] = offset;
    10741078    codeBlock->refStructures(vPC);
    10751079}

  • trunk/JavaScriptCore/jit/JITStubs.cpp

    r53151 r53341  
    890890
    891891        JSObject* slotBaseObject = asObject(slot.slotBase());
    892 
     892        size_t offset = slot.cachedOffset();
     893       
    893894        // Since we're accessing a prototype in a loop, it's a good bet that it
    894895        // should not be treated as a dictionary.
    895         if (slotBaseObject->structure()->isDictionary())
     896        if (slotBaseObject->structure()->isDictionary()) {
    896897            slotBaseObject->flattenDictionaryObject();
     898            offset = slotBaseObject->structure()->get(propertyName);
     899        }
    897900       
    898901        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
    … …  
    900903        ASSERT(!structure->isDictionary());
    901904        ASSERT(!slotBaseObject->structure()->isDictionary());
    902         JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
     905        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), offset, returnAddress);
    903906        return;
    904907    }
    905908
    906     size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     909    size_t offset = slot.cachedOffset();
     910    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
    907911    if (!count) {
    908912        stubInfo->accessType = access_get_by_id_generic;
    … …  
    912916    StructureChain* prototypeChain = structure->prototypeChain(callFrame);
    913917    stubInfo->initGetByIdChain(structure, prototypeChain);
    914     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
     918    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, offset, returnAddress);
    915919}
    916920
    … …  
    14371441
    14381442    CallFrame* callFrame = stackFrame.callFrame;
     1443    const Identifier& propertyName = stackFrame.args[1].identifier();
    14391444
    14401445    JSValue baseValue = stackFrame.args[0].jsValue();
    14411446    PropertySlot slot(baseValue);
    1442     JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
     1447    JSValue result = baseValue.get(callFrame, propertyName, slot);
    14431448
    14441449    CHECK_FOR_EXCEPTION();
    … …  
    14551460    ASSERT(slot.slotBase().isObject());
    14561461    JSObject* slotBaseObject = asObject(slot.slotBase());
     1462   
     1463    size_t offset = slot.cachedOffset();
    14571464
    14581465    if (slot.slotBase() == baseValue)
    … …  
    14621469        // Since we're accessing a prototype in a loop, it's a good bet that it
    14631470        // should not be treated as a dictionary.
    1464         if (slotBaseObject->structure()->isDictionary())
     1471        if (slotBaseObject->structure()->isDictionary()) {
    14651472            slotBaseObject->flattenDictionaryObject();
     1473            offset = slotBaseObject->structure()->get(propertyName);
     1474        }
    14661475
    14671476        int listIndex;
    14681477        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
    14691478
    1470         JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
     1479        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), offset);
    14711480
    14721481        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
    14731482            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
    1474     } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
     1483    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
    14751484        ASSERT(!asCell(baseValue)->structure()->isDictionary());
    14761485        int listIndex;
    … …  
    14781487
    14791488        StructureChain* protoChain = structure->prototypeChain(callFrame);
    1480         JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
     1489        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, offset);
    14811490
    14821491        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))

  • trunk/JavaScriptCore/runtime/Operations.h

    r52182 r53341  
    340340    }
    341341
    342     inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
     342    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, size_t& slotOffset)
    343343    {
    344344        JSCell* cell = asCell(base);
    … …  
    358358            // Since we're accessing a prototype in a loop, it's a good bet that it
    359359            // should not be treated as a dictionary.
    360             if (cell->structure()->isDictionary())
     360            if (cell->structure()->isDictionary()) {
    361361                asObject(cell)->flattenDictionaryObject();
     362                if (slotBase == cell)
     363                    slotOffset = cell->structure()->get(propertyName);
     364            }
    362365
    363366            ++count;

  • trunk/LayoutTests/ChangeLog

    r53337 r53341  
     12010-01-15  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        REGRESISON: Google maps buttons not working properly
     6        https://bugs.webkit.org/show_bug.cgi?id=31871
     7
     8        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
     9        getting directions for a second time
     10        https://bugs.webkit.org/show_bug.cgi?id=33446
     11       
     12        Added a test for these bugs.
     13
     14        * fast/js/pic/undictionary-expected.txt: Added.
     15        * fast/js/pic/undictionary.html: Added.
     16
    1172010-01-15  Ojan Vafai  <ojan@chromium.org>
    218
Note: See TracChangeset for help on using the changeset viewer.