Changeset 54073 in webkit for trunk/JavaScriptCore/runtime/Structure.cpp

Timestamp:

Jan 29, 2010, 11:46:57 AM (15 years ago)

Author:

[email protected]

Message:

2010-01-29 Oliver Hunt <​[email protected]>

Reviewed by Darin Adler.

JSC is failing to propagate anonymous slot count on some transitions
​https://bugs.webkit.org/show_bug.cgi?id=34321

Remove the unsafe two argument Structure::create method, and correct
the uses of it to propagate the anonymous slot count.

• runtime/JSObject.h: (JSC::JSObject::setStructure):
• runtime/Structure.cpp: (JSC::Structure::addPropertyTransition): (JSC::Structure::changePrototypeTransition): (JSC::Structure::despecifyFunctionTransition): (JSC::Structure::getterSetterTransition): (JSC::Structure::toDictionaryTransition):
• runtime/Structure.h:

2010-01-29 Oliver Hunt <​[email protected]>

Reviewed by Darin Adler.

JSC is failing to propagate anonymous slot count on some transitions
​https://bugs.webkit.org/show_bug.cgi?id=34321

Add a test for modification of a type with anonymous slots.

• fast/dom/Window/anonymous-slot-with-changes-expected.txt: Added.
• fast/dom/Window/anonymous-slot-with-changes.html: Added.

2010-01-29 Oliver Hunt <​[email protected]>

Reviewed by Darin Adler.

JSC is failing to propagate anonymous slot count on some transitions
​https://bugs.webkit.org/show_bug.cgi?id=34321

Make code generator add assertions for anonymous slot count.

Test: fast/dom/Window/anonymous-slot-with-changes.html

• bindings/scripts/CodeGeneratorJS.pm:

File:

• trunk/JavaScriptCore/runtime/Structure.cpp (modified) (5 diffs)

trunk/JavaScriptCore/runtime/Structure.cpp

@@ -367 +367 @@
     }
 
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
@@ -416 +416 @@
 PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
-    RefPtr<Structure> transition = create(prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(prototype, structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
@@ -435 +435 @@
 {
     ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
@@ -460 +460 @@
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
@@ -479 +479 @@
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+    RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;