Changeset 222901 in webkit for trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

Timestamp:

Oct 5, 2017, 12:38:00 AM (8 years ago)

Author:

[email protected]

Message:

Make sure all prototypes under poly proto get added into the VM's prototype map
​https://bugs.webkit.org/show_bug.cgi?id=177909

Reviewed by Keith Miller.

JSTests:

• stress/poly-proto-prototype-map-having-a-bad-time.js: Added.

(assert):
(foo.C):
(foo):
(set x):

Source/JavaScriptCore:

This is an invariant of prototypes that I broke when doing poly proto. This patch fixes it.

• JavaScriptCore.xcodeproj/project.pbxproj:
• bytecode/BytecodeList.json:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGOperations.cpp:
• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/JSCInlines.h:
• runtime/PrototypeMap.cpp:

(JSC::PrototypeMap::addPrototype): Deleted.

• runtime/PrototypeMap.h:
• runtime/PrototypeMapInlines.h:

(JSC::PrototypeMap::isPrototype const):
(JSC::PrototypeMap::addPrototype):

File:

• trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -30 +30 @@
 #include "ArrayConstructor.h"
 #include "BuiltinNames.h"
+#include "BytecodeStructs.h"
 #include "CallFrame.h"
 #include "ClonedArguments.h"
@@ -94 +95 @@
 #define OP_C(index) (exec->r(pc[index].u.operand))
 
+#define GET(operand) (exec->uncheckedR(operand))
+
 #define RETURN_TWO(first, second) do {       \
         return encodeResult(first, second);        \
@@ -230 +233 @@
 {
     BEGIN();
+    auto& bytecode = *reinterpret_cast<OpCreateThis*>(pc);
     JSObject* result;
-    JSObject* constructorAsObject = asObject(OP(2).jsValue());
+    JSObject* constructorAsObject = asObject(GET(bytecode.callee()).jsValue());
     if (constructorAsObject->type() == JSFunctionType) {
         JSFunction* constructor = jsCast<JSFunction*>(constructorAsObject);
-        auto& cacheWriteBarrier = pc[4].u.jsCell;
-        if (!cacheWriteBarrier)
-            cacheWriteBarrier.set(vm, exec->codeBlock(), constructor);
-        else if (cacheWriteBarrier.unvalidatedGet() != JSCell::seenMultipleCalleeObjects() && cacheWriteBarrier.get() != constructor)
-            cacheWriteBarrier.setWithoutWriteBarrier(JSCell::seenMultipleCalleeObjects());
-
-        size_t inlineCapacity = pc[3].u.operand;
+        WriteBarrier<JSCell>& cachedCallee = bytecode.cachedCallee();
+        if (!cachedCallee)
+            cachedCallee.set(vm, exec->codeBlock(), constructor);
+        else if (cachedCallee.unvalidatedGet() != JSCell::seenMultipleCalleeObjects() && cachedCallee.get() != constructor)
+            cachedCallee.setWithoutWriteBarrier(JSCell::seenMultipleCalleeObjects());
+
+        size_t inlineCapacity = bytecode.inlineCapacity();
         Structure* structure = constructor->rareData(exec, inlineCapacity)->objectAllocationProfile()->structure();
         result = constructEmptyObject(exec, structure);
-        if (structure->hasPolyProto())
-            result->putDirect(vm, structure->polyProtoOffset(), constructor->prototypeForConstruction(vm, exec));
+        if (structure->hasPolyProto()) {
+            JSObject* prototype = constructor->prototypeForConstruction(vm, exec);
+            result->putDirect(vm, structure->polyProtoOffset(), prototype);
+            vm.prototypeMap.addPrototype(prototype);
+        }
     } else {
         // http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor