Changeset 53341 in webkit for trunk/JavaScriptCore/interpreter

Timestamp:

Jan 15, 2010, 12:48:52 PM (15 years ago)

Author:

[email protected]

Message:

2010-01-14 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

REGRESISON: Google maps buttons not working properly
​https://bugs.webkit.org/show_bug.cgi?id=31871

REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
getting directions for a second time
​https://bugs.webkit.org/show_bug.cgi?id=33446

SunSpider and v8 report no change.

• interpreter/Interpreter.cpp: (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case flattening the dictionary changed any of its offsets.

• jit/JITStubs.cpp: (JSC::JITThunks::tryCacheGetByID): (JSC::DEFINE_STUB_FUNCTION):
• runtime/Operations.h: (JSC::normalizePrototypeChain): ditto

2010-01-15 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

REGRESISON: Google maps buttons not working properly
​https://bugs.webkit.org/show_bug.cgi?id=31871

REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
getting directions for a second time
​https://bugs.webkit.org/show_bug.cgi?id=33446

Added a test for these bugs.

• fast/js/pic/undictionary-expected.txt: Added.
• fast/js/pic/undictionary.html: Added.

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (4 diffs)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -1045 +1045 @@
 
         JSObject* baseObject = asObject(slot.slotBase());
+        size_t offset = slot.cachedOffset();
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary())
+        if (baseObject->structure()->isDictionary()) {
             baseObject->flattenDictionaryObject();
+            offset = baseObject->structure()->get(propertyName);
+        }
 
         ASSERT(!baseObject->structure()->isUncacheableDictionary());
@@ -1055 +1058 @@
         vPC[0] = getOpcode(op_get_by_id_proto);
         vPC[5] = baseObject->structure();
-        vPC[6] = slot.cachedOffset();
+        vPC[6] = offset;
 
         codeBlock->refStructures(vPC);
@@ -1061 +1064 @@
     }
 
-    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
+    size_t offset = slot.cachedOffset();
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
@@ -1071 +1075 @@
     vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
-    vPC[7] = slot.cachedOffset();
+    vPC[7] = offset;
     codeBlock->refStructures(vPC);
 }