Changeset 225891 in webkit for trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

Timestamp:

Dec 13, 2017, 8:10:02 PM (7 years ago)

Author:

[email protected]

Message:

Arrow functions need their own structure because they have different properties than sloppy functions
​https://bugs.webkit.org/show_bug.cgi?id=180779
<rdar://problem/35814591>

Reviewed by Mark Lam.

JSTests:

• stress/arrow-function-needs-its-own-structure.js: Added.

(assert):
(readPrototype):
(noInline.let.f1):
(noInline):

Source/JavaScriptCore:

We were using the same structure for sloppy functions and
arrow functions. This broke our IC caching machinery because
these two types of functions actually have different properties.
This patch gives them different structures.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewFunction):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):

• runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

• runtime/JSFunction.cpp:

(JSC::JSFunction::selectStructureForNewFuncExp):
(JSC::JSFunction::create):

• runtime/JSFunction.h:
• runtime/JSFunctionInlines.h:

(JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::arrowFunctionStructure const):

File:

• trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

@@ -323 +323 @@
     WriteBarrier<Structure> m_calleeStructure;
     WriteBarrier<Structure> m_strictFunctionStructure;
+    WriteBarrier<Structure> m_arrowFunctionStructure;
     WriteBarrier<Structure> m_sloppyFunctionStructure;
     LazyProperty<JSGlobalObject, Structure> m_boundFunctionStructure;
@@ -632 +633 @@
     Structure* strictFunctionStructure() const { return m_strictFunctionStructure.get(); }
     Structure* sloppyFunctionStructure() const { return m_sloppyFunctionStructure.get(); }
+    Structure* arrowFunctionStructure() const { return m_arrowFunctionStructure.get(); }
     Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(this); }
     Structure* customGetterSetterFunctionStructure() const { return m_customGetterSetterFunctionStructure.get(this); }