Changeset 96135 in webkit

Timestamp:

Sep 27, 2011 11:19:01 AM (13 years ago)

Author:

commit-queue@webkit.org

Message:

[v8] Code calling the typed array optimization script is fragile, depends on typed array hierarchy.

Install the flag, which indicates whether or not the optimization
script was executed, on the global object.

​https://bugs.webkit.org/show_bug.cgi?id=68890

Patch by Ulan Degenbaev <​ulan@chromium.org> on 2011-09-27
Reviewed by Kenneth Russell.

• Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp:

Location:

trunk

Files:

• ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp (modified) (2 diffs)

trunk/ChangeLog

@@ +1 @@
+2011-09-27  Ulan Degenbaev  <ulan@chromium.org>
+
+        [v8] Code calling the typed array optimization script is fragile, depends on typed array hierarchy.
+
+        Install the flag, which indicates whether or not the optimization
+        script was executed, on the global object.
+
+        https://bugs.webkit.org/show_bug.cgi?id=68890
+
+        Reviewed by Kenneth Russell.
+
+        * Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp:
+
 2011-09-27  Sheriff Bot  <webkit.review.bot@gmail.com>
 

trunk/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp

@@ -33 +33 @@
 namespace WebCore {
 
-const char fastSetFlagName[] = "webgl::FastSetFlag";
+// The random suffix helps to avoid name collision.
+const char fastSetFlagName[] = "TypedArray::FastSet::8NkZVq";
 
 bool fastSetInstalled(v8::Handle<v8::Object> array)
 {
-    // Use a hidden flag in the common prototype (ArrayBufferView) of all typed
-    // arrays as an indicator of whether the fast 'set' is installed or not.
-    v8::Handle<v8::Object> prototype = array->GetPrototype().As<v8::Object>();
-    v8::Handle<v8::Object> arrayBufferView = prototype->GetPrototype().As<v8::Object>();
+    // Use a hidden flag in the global object an indicator of whether the fast
+    // 'set' is installed or not.
+    v8::Handle<v8::Object> global = array->CreationContext()->Global();
     v8::Handle<v8::String> key = v8::String::New(fastSetFlagName);
-    v8::Handle<v8::Value> fastSetFlag = arrayBufferView->GetHiddenValue(key);
+    v8::Handle<v8::Value> fastSetFlag = global->GetHiddenValue(key);
     return !fastSetFlag.IsEmpty();
 }
@@ -48 +48 @@
 void installFastSet(v8::Handle<v8::Object> array)
 {
-    v8::Handle<v8::Object> prototype = array->GetPrototype().As<v8::Object>();
-    v8::Handle<v8::Object> arrayBufferView = prototype->GetPrototype().As<v8::Object>();
+    v8::Handle<v8::Object> global = array->CreationContext()->Global();
     v8::Handle<v8::String> key = v8::String::New(fastSetFlagName);
-    arrayBufferView->SetHiddenValue(key, v8::Boolean::New(true));
+    global->SetHiddenValue(key, v8::Boolean::New(true));
 
     String source(reinterpret_cast<const char*>(V8ArrayBufferViewCustomScript_js),