Changeset 45039 in webkit for trunk/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Jun 23, 2009, 7:47:48 PM (16 years ago)

Author:

[email protected]

Message:

<rdar://problem/6992806> REGRESSION: Enumeration can skip new properties in cases of prototypes that have more than 64 (26593)
<​https://bugs.webkit.org/show_bug.cgi?id=26593>

Reviewed by Gavin Barraclough.

Add tests to ensure we correctly invalidate caching that depends on structure chains
that include dictionaries.

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (3 diffs)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -971 +971 @@
     }
 
+    StructureChain* protoChain = structure->prototypeChain(callFrame);
+    if (!protoChain->isCacheable()) {
+        vPC[0] = getOpcode(op_put_by_id_generic);
+        return;
+    }
+
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
@@ -976 +982 @@
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        vPC[6] = structure->prototypeChain(callFrame);
+        vPC[6] = protoChain;
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
@@ -1078 +1084 @@
     }
 
+    StructureChain* protoChain = structure->prototypeChain(callFrame);
+    if (!protoChain->isCacheable()) {
+        vPC[0] = getOpcode(op_put_by_id_generic);
+        return;
+    }
+
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = structure->prototypeChain(callFrame);
+    vPC[5] = protoChain;
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();