Changeset 154113 in webkit for trunk/Source/JavaScriptCore/runtime/Arguments.cpp

Timestamp:

Aug 15, 2013, 11:49:05 AM (12 years ago)

Author:

[email protected]

Message:

​https://bugs.webkit.org/show_bug.cgi?id=119843
PropertySlot::setValue is ambiguous

Reviewed by Geoff Garen.

There are three different versions of PropertySlot::setValue, one for cacheable properties, and two that are used interchangeably and inconsistently.
The problematic variants are the ones that just take a value, and one that takes a value and also the object containing the property.
Unify on always providing the object, and remove the version that just takes a value.
This always works except for JSString, where we optimize out the object (logically we should be instantiating a temporary StringObject on every property access).
Provide a version of setValue that takes a JSString as the owner of the property.
We won't store this, but it makes it clear that this interface should only be used from JSString.

• API/JSCallbackObjectFunctions.h:

(JSC::::getOwnPropertySlot):

• JSCTypedArrayStubs.h:
• runtime/Arguments.cpp:

(JSC::Arguments::getOwnPropertySlotByIndex):
(JSC::Arguments::getOwnPropertySlot):

• runtime/JSActivation.cpp:

(JSC::JSActivation::symbolTableGet):
(JSC::JSActivation::getOwnPropertySlot):

• runtime/JSArray.cpp:

(JSC::JSArray::getOwnPropertySlot):

• runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertySlotByIndex):

• runtime/JSString.h:

(JSC::JSString::getStringPropertySlot):

• runtime/JSSymbolTableObject.h:

(JSC::symbolTableGet):

• runtime/SparseArrayValueMap.cpp:

(JSC::SparseArrayEntry::get):

• Pass object containing property to PropertySlot::setValue

• runtime/PropertySlot.h:

(JSC::PropertySlot::setValue):

• Logically, the base of a string property access is a temporary StringObject, but we optimize that away.

(JSC::PropertySlot::setUndefined):

• removed setValue(JSValue), added setValue(JSString*, JSValue)

File:

• trunk/Source/JavaScriptCore/runtime/Arguments.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/Arguments.cpp

@@ -95 +95 @@
     Arguments* thisObject = jsCast<Arguments*>(object);
     if (JSValue value = thisObject->tryGetArgument(i)) {
-        slot.setValue(value);
+        slot.setValue(thisObject, value);
         return true;
     }
@@ -130 +130 @@
     if (JSValue value = thisObject->tryGetArgument(i)) {
         RELEASE_ASSERT(i < PropertyName::NotAnIndex);
-        slot.setValue(value);
+        slot.setValue(thisObject, value);
         return true;
     }
 
     if (propertyName == exec->propertyNames().length && LIKELY(!thisObject->m_overrodeLength)) {
-        slot.setValue(jsNumber(thisObject->m_numArguments));
+        slot.setValue(thisObject, jsNumber(thisObject->m_numArguments));
         return true;
     }
@@ -141 +141 @@
     if (propertyName == exec->propertyNames().callee && LIKELY(!thisObject->m_overrodeCallee)) {
         if (!thisObject->m_isStrictMode) {
-            slot.setValue(thisObject->m_callee.get());
+            slot.setValue(thisObject, thisObject->m_callee.get());
             return true;
         }