Changeset 55181 in webkit for trunk/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Feb 23, 2010, 8:27:46 PM (15 years ago)

Author:

[email protected]

Message:

2010-02-23 Oliver Hunt <​[email protected]>

Reviewed by Maciej Stachowiak.

Web Inspector: Regression: r55027+: Inspector broken
​https://bugs.webkit.org/show_bug.cgi?id=35253

op_get_by_id_getter_chain was not passing the correct this parameter.
The bug was caused by incorrect use of baseCell instead of baseValue,
baseValue contains the original object for the lookup (and hence the
correct this object), baseCell is clobbered as part of walking the
prototype chain.

• interpreter/Interpreter.cpp: (JSC::Interpreter::privateExecute):

2010-02-23 Oliver Hunt <​[email protected]>

Reviewed by Maciej Stachowiak.

Web Inspector: Regression: r55027+: Inspector broken
​https://bugs.webkit.org/show_bug.cgi?id=35253

Add thorough testing of getter access to hit the various
possible caching scenarios.

• fast/js/pic/cached-getter-setter-expected.txt:
• fast/js/pic/cached-getter-setter.html:

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -2380 +2380 @@
                             CallData callData;
                             CallType callType = getter->getCallData(callData);
-                            JSValue result = call(callFrame, getter, callType, callData, asObject(baseCell), ArgList());
+                            JSValue result = call(callFrame, getter, callType, callData, baseValue, ArgList());
                             CHECK_FOR_EXCEPTION();
                             callFrame->r(dst) = result;