Changeset 34945 in webkit for trunk/JavaScriptCore/VM/Machine.cpp

Timestamp:

Jul 1, 2008, 10:39:23 PM (17 years ago)

Author:

[email protected]

Message:

2008-07-01 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

Removed and/or reordered exception checks in array-style a[n] access.

SunSpider says 1.4% faster.

• VM/Machine.cpp: (KJS::Machine::privateExecute): No need to check for exceptions before calling toString, toNumber and/or get. If the call ends up being observable through toString, valueOf, or a getter, we short-circuit it there, instead. In the op_del_by_val case, I removed the incorrect comment without actually removing the code, since I didn't want to tempt the GCC fates!

• kjs/JSObject.cpp: (KJS::callDefaultValueFunction): Added exception check to prevent toString and valueOf functions from observing execution after an exception has been thrown. This removes some of the burden of exception checking from the machine.

(KJS::JSObject::defaultValue): Removed redundant exception check here.

• kjs/PropertySlot.cpp: (KJS::PropertySlot::functionGetter): Added exception check to prevent getter functions from observing execution after an exception has been thrown. This removes some of the burden of exception checking from the machine.

File:

• trunk/JavaScriptCore/VM/Machine.cpp (modified) (3 diffs)

trunk/JavaScriptCore/VM/Machine.cpp

@@ -1839 +1839 @@
             result = baseValue->get(exec, i);
         else {
-            JSObject* baseObj = baseValue->toObject(exec); // may throw
-        
-            Identifier property;
-            if (subscript->isObject()) {
-                VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
-                property = Identifier(exec, subscript->toString(exec));
-            } else
-                property = Identifier(exec, subscript->toString(exec));
-
-            VM_CHECK_EXCEPTION(); // This check is needed to prevent us from incorrectly calling a getter after an exception is thrown
-            result = baseObj->get(exec, property);
+            Identifier property(exec, subscript->toString(exec));
+            result = baseValue->get(exec, property);
         }
 
@@ -1881 +1872 @@
             baseValue->put(exec, i, r[value].u.jsValue);
         else {
-            JSObject* baseObj = baseValue->toObject(exec);
-
-            Identifier property;
-            if (subscript->isObject()) {
-                VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
-                property = Identifier(exec, subscript->toString(exec));
-            } else
-                property = Identifier(exec, subscript->toString(exec));
-
-            VM_CHECK_EXCEPTION(); // This check is needed to prevent us from incorrectly calling a setter after an exception is thrown
-            baseObj->put(exec, property, r[value].u.jsValue);
+            Identifier property(exec, subscript->toString(exec));
+            if (!exec->hadException()) // Don't put to an object if toString threw an exception.
+                baseValue->put(exec, property, r[value].u.jsValue);
         }
 
@@ -1918 +1901 @@
             result = jsBoolean(baseObj->deleteProperty(exec, i));
         else {
-            VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
+            VM_CHECK_EXCEPTION();
             Identifier property(exec, subscript->toString(exec));
             VM_CHECK_EXCEPTION();