Changeset 172794 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Aug 19, 2014, 7:38:46 PM (11 years ago)

Author:

[email protected]

Message:

REGRESSION(r172401): for-in optimization no longer works at all
​https://bugs.webkit.org/show_bug.cgi?id=136056

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Roll this back in, along with a fix to make proxies work. Previously, for-in over proxies
would instacrash every time.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitGetByVal):
(JSC::BytecodeGenerator::pushIndexedForInScope):
(JSC::BytecodeGenerator::pushStructureForInScope):

• bytecompiler/BytecodeGenerator.h:

(JSC::ForInContext::ForInContext):
(JSC::StructureForInContext::StructureForInContext):
(JSC::IndexedForInContext::IndexedForInContext):
(JSC::ForInContext::base): Deleted.

• bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitMultiLoopBytecode):

• runtime/JSProxy.cpp:

(JSC::JSProxy::getStructurePropertyNames):
(JSC::JSProxy::getGenericPropertyNames):

• tests/stress/for-in-base-reassigned-later-and-change-structure.js: Added.

(foo):

• tests/stress/for-in-base-reassigned-later.js: Added.

(foo):

• tests/stress/for-in-base-reassigned.js: Added.

(foo):

• tests/stress/for-in-proxy-target-changed-structure.js: Added.

(deleteAll):
(foo):

• tests/stress/for-in-proxy.js: Added.

(foo):

LayoutTests:

This just needs a rebase because the number of calls into the DOM has changed and so the
number of console messages about security stuff has now changed.

• http/tests/security/cross-frame-access-enumeration-expected.txt:

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -2071 +2071 @@
         this->emitLoopHeader(generator, propertyName.get());
 
-        generator.pushIndexedForInScope(base.get(), local.get(), i.get());
+        generator.pushIndexedForInScope(local.get(), i.get());
         generator.emitNode(dst, m_statement);
         generator.popIndexedForInScope(local.get());
@@ -2105 +2105 @@
         this->emitLoopHeader(generator, propertyName.get());
 
-        generator.pushStructureForInScope(base.get(), local.get(), i.get(), propertyName.get(), structureEnumerator.get());
+        generator.pushStructureForInScope(local.get(), i.get(), propertyName.get(), structureEnumerator.get());
         generator.emitNode(dst, m_statement);
         generator.popStructureForInScope(local.get());