Changeset 84882 in webkit


Ignore:
Timestamp:
Apr 25, 2011 11:23:14 PM (13 years ago)
Author:
ggaren@apple.com
Message:

2011-04-25 Geoffrey Garen <​ggaren@apple.com>

Reviewed by Oliver Hunt.

Custom prototypes on DOM objects don't persist after garbage collection
​https://bugs.webkit.org/show_bug.cgi?id=59412


SunSpider reports no change.


The hasCustomProperties() check didn't check for a custom prototype.

  • runtime/JSObject.h: (JSC::JSObject::hasCustomProperties): Changed to delegate to Structure because it is the "truth" about an object's pedigree.
  • runtime/Structure.cpp: (JSC::Structure::Structure):
  • runtime/Structure.h: (JSC::Structure::didTransition): Track whether a Structure has ever transitioned for any reason. If so, we have to assume that the object holding it is custom in some way.

2011-04-25 Geoffrey Garen <​ggaren@apple.com>

Reviewed by Oliver Hunt.

Custom prototypes on DOM objects don't persist after garbage collection
​https://bugs.webkit.org/show_bug.cgi?id=59412

  • fast/dom/gc-custom-prototype-expected.txt: Added.
  • fast/dom/gc-custom-prototype.html: Added.
  • fast/dom/script-tests/dataset-gc.js:
Location:
trunk
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r84878 r84882  
     12011-04-25  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        Custom prototypes on DOM objects don't persist after garbage collection
     6        https://bugs.webkit.org/show_bug.cgi?id=59412
     7
     8        * fast/dom/gc-custom-prototype-expected.txt: Added.
     9        * fast/dom/gc-custom-prototype.html: Added.
     10        * fast/dom/script-tests/dataset-gc.js:
     11
    1122011-04-25  Daniel Bates  <dbates@webkit.org>
    213

  • trunk/Source/JavaScriptCore/ChangeLog

    r84860 r84882  
     12011-04-25  Geoffrey Garen  <ggaren@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        Custom prototypes on DOM objects don't persist after garbage collection
     6        https://bugs.webkit.org/show_bug.cgi?id=59412
     7       
     8        SunSpider reports no change.
     9       
     10        The hasCustomProperties() check didn't check for a custom prototype.
     11
     12        * runtime/JSObject.h:
     13        (JSC::JSObject::hasCustomProperties): Changed to delegate to Structure
     14        because it is the "truth" about an object's pedigree.
     15
     16        * runtime/Structure.cpp:
     17        (JSC::Structure::Structure):
     18        * runtime/Structure.h:
     19        (JSC::Structure::didTransition): Track whether a Structure has ever
     20        transitioned for any reason. If so, we have to assume that the object
     21        holding it is custom in some way.
     22
    1232011-04-25  Gavin Barraclough  <barraclough@apple.com>
    224

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r84556 r84882  
    174174
    175175        void removeDirect(JSGlobalData&, const Identifier& propertyName);
    176         bool hasCustomProperties() { return !m_structure->isEmpty(); }
     176        bool hasCustomProperties() { return m_structure->didTransition(); }
    177177        bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
    178178

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r84804 r84882  
    190190    , m_anonymousSlotCount(anonymousSlotCount)
    191191    , m_preventExtensions(false)
     192    , m_didTransition(false)
    192193{
    193194    ASSERT(m_prototype);
    … …  
    212213    , m_anonymousSlotCount(0)
    213214    , m_preventExtensions(false)
     215    , m_didTransition(false)
    214216{
    215217    ASSERT(m_prototype);
    … …  
    233235    , m_anonymousSlotCount(previous->anonymousSlotCount())
    234236    , m_preventExtensions(previous->m_preventExtensions)
     237    , m_didTransition(true)
    235238{
    236239    ASSERT(m_prototype);

  • trunk/Source/JavaScriptCore/runtime/Structure.h

    r84804 r84882  
    8585        bool isFrozen(JSGlobalData&);
    8686        bool isExtensible() const { return !m_preventExtensions; }
     87        bool didTransition() const { return m_didTransition; }
    8788
    8889        Structure* flattenDictionaryStructure(JSGlobalData&, JSObject*);
    … …  
    248249        unsigned m_anonymousSlotCount : 5;
    249250        unsigned m_preventExtensions : 1;
    250         // 4 free bits
     251        unsigned m_didTransition : 1;
     252        // 3 free bits
    251253    };
    252254
Note: See TracChangeset for help on using the changeset viewer.