Changeset 50443 in webkit for trunk/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Nov 2, 2009, 10:49:42 PM (16 years ago)

Author:

[email protected]

Message:

REGRESSION (r48573): JSC may incorrectly cache chain lookups with a dictionary at the head of the chain
​https://bugs.webkit.org/show_bug.cgi?id=31045

Reviewed by Gavin Barraclough.

Add guards to prevent caching of prototype chain lookups with dictionaries at the
head of the chain. Also add a few tighter assertions to cached prototype lookups
to catch this in future.

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (4 diffs)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -1030 +1030 @@
     }
 
+    if (structure->isDictionary()) {
+        vPC[0] = getOpcode(op_get_by_id_generic);
+        return;
+    }
+
     if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
         ASSERT(slot.slotBase().isObject());
@@ -1039 +1044 @@
         if (baseObject->structure()->isDictionary())
             baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
+
+        ASSERT(!baseObject->structure()->isUncacheableDictionary());
 
         vPC[0] = getOpcode(op_get_by_id_proto);
@@ -2135 +2142 @@
 
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
+                    ASSERT(baseValue.get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
                     callFrame->r(dst) = JSValue(protoObject->getDirectOffset(offset));
 
@@ -2190 +2198 @@
 
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
+                        ASSERT(baseValue.get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                         callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));