Attachment 251758 Details for Bug 144265 – the patch

[patch] the patch

patch.diff (text/plain), 2.80 KB, created by Saam Barati on 2015-04-27 10:59:13 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Saam Barati

Created: 2015-04-27 10:59:13 PDT

Size: 2.80 KB

patch

obsolete

>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 183399)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,18 @@
>+2015-04-27  Saam Barati  <saambarati1@gmail.com>
>+
>+        JSScope::abstractResolve does not always adhere to the global object's structure's request to not cache property accesses
>+        https://bugs.webkit.org/show_bug.cgi?id=144265
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        abstractAccess used to check if the global object's structure disallows property 
>+        access caching *after* seeing if the property is in the global object's symbol table.
>+        This check should happen *before* checking the symbol table because if the ordering 
>+        wasn't like this there is a chance we may cache an access that shouldn't be cached.
>+
>+        * runtime/JSScope.cpp:
>+        (JSC::abstractAccess):
>+
> 2015-04-26  Ryosuke Niwa  <rniwa@webkit.org>
> 
>         Class body ending with a semicolon throws a SyntaxError
>Index: Source/JavaScriptCore/runtime/JSScope.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSScope.cpp	(revision 183299)
>+++ Source/JavaScriptCore/runtime/JSScope.cpp	(working copy)
>@@ -72,6 +72,14 @@ static inline bool abstractAccess(ExecSt
>     }
> 
>     if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(scope)) {
>+        if (!globalObject->structure()->propertyAccessesAreCacheable()
>+            || (globalObject->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto() && getOrPut == Put)) {
>+            // We know the property will be at global scope, but we don't know how to cache it.
>+            ASSERT(!scope->next());
>+            op = ResolveOp(makeType(GlobalProperty, needsVarInjectionChecks), depth, 0, 0, 0, 0);
>+            return true;
>+        }
>+
>         SymbolTableEntry entry = globalObject->symbolTable()->get(ident.impl());
>         if (!entry.isNull()) {
>             if (getOrPut == Put && entry.isReadOnly()) {
>@@ -87,10 +95,7 @@ static inline bool abstractAccess(ExecSt
>         }
> 
>         PropertySlot slot(globalObject);
>-        if (!globalObject->getOwnPropertySlot(globalObject, exec, ident, slot)
>-            || !slot.isCacheableValue()
>-            || !globalObject->structure()->propertyAccessesAreCacheable()
>-            || (globalObject->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto() && getOrPut == Put)) {
>+        if (!globalObject->getOwnPropertySlot(globalObject, exec, ident, slot) || !slot.isCacheableValue()) {
>             // We know the property will be at global scope, but we don't know how to cache it.
>             ASSERT(!scope->next());
>             op = ResolveOp(makeType(GlobalProperty, needsVarInjectionChecks), depth, 0, 0, 0, 0);

Flags:

ggaren: review-

Actions: View | Formatted Diff | Diff

Attachments on bug 144265: 251758 | 251774 | 251797