[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.19-706-ge5415e9
oliver at apple.com
oliver at apple.com
Thu Feb 4 21:32:35 UTC 2010
The following commit has been merged in the webkit-1.1 branch:
commit 5ddc755b1b452a769da948b65aa8fc1c008be138
Author: oliver at apple.com <oliver at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Jan 29 19:46:57 2010 +0000
2010-01-29 Oliver Hunt <oliver at apple.com>
Reviewed by Darin Adler.
JSC is failing to propagate anonymous slot count on some transitions
https://bugs.webkit.org/show_bug.cgi?id=34321
Remove the unsafe two argument Structure::create method, and correct
the uses of it to propagate the anonymous slot count.
* runtime/JSObject.h:
(JSC::JSObject::setStructure):
* runtime/Structure.cpp:
(JSC::Structure::addPropertyTransition):
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::getterSetterTransition):
(JSC::Structure::toDictionaryTransition):
* runtime/Structure.h:
2010-01-29 Oliver Hunt <oliver at apple.com>
Reviewed by Darin Adler.
JSC is failing to propagate anonymous slot count on some transitions
https://bugs.webkit.org/show_bug.cgi?id=34321
Add a test for modification of a type with anonymous slots.
* fast/dom/Window/anonymous-slot-with-changes-expected.txt: Added.
* fast/dom/Window/anonymous-slot-with-changes.html: Added.
2010-01-29 Oliver Hunt <oliver at apple.com>
Reviewed by Darin Adler.
JSC is failing to propagate anonymous slot count on some transitions
https://bugs.webkit.org/show_bug.cgi?id=34321
Make code generator add assertions for anonymous slot count.
Test: fast/dom/Window/anonymous-slot-with-changes.html
* bindings/scripts/CodeGeneratorJS.pm:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@54073 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index f427df0..7fed4c7 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,23 @@
+2010-01-29 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Darin Adler.
+
+ JSC is failing to propagate anonymous slot count on some transitions
+ https://bugs.webkit.org/show_bug.cgi?id=34321
+
+ Remove the unsafe two argument Structure::create method, and correct
+ the uses of it to propagate the anonymous slot count.
+
+ * runtime/JSObject.h:
+ (JSC::JSObject::setStructure):
+ * runtime/Structure.cpp:
+ (JSC::Structure::addPropertyTransition):
+ (JSC::Structure::changePrototypeTransition):
+ (JSC::Structure::despecifyFunctionTransition):
+ (JSC::Structure::getterSetterTransition):
+ (JSC::Structure::toDictionaryTransition):
+ * runtime/Structure.h:
+
2010-01-29 Simon Hausmann <simon.hausmann at nokia.com>
Rubber-stamped by Maciej Stachowiak.
diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index 2b31a65..652eb76 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -315,6 +315,7 @@ inline void JSObject::setPrototype(JSValue prototype)
inline void JSObject::setStructure(NonNullPassRefPtr<Structure> structure)
{
+ ASSERT(structure->anonymousSlotCount() == m_structure->anonymousSlotCount());
m_structure->deref();
m_structure = structure.releaseRef(); // ~JSObject balances this ref()
}
diff --git a/JavaScriptCore/runtime/Structure.cpp b/JavaScriptCore/runtime/Structure.cpp
index 77330aa..eeea172 100644
--- a/JavaScriptCore/runtime/Structure.cpp
+++ b/JavaScriptCore/runtime/Structure.cpp
@@ -366,7 +366,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
return transition.release();
}
- RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+ RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
transition->m_previous = structure;
@@ -415,7 +415,7 @@ PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure,
PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
{
- RefPtr<Structure> transition = create(prototype, structure->typeInfo());
+ RefPtr<Structure> transition = create(prototype, structure->typeInfo(), structure->anonymousSlotCount());
transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
@@ -434,7 +434,7 @@ PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure,
PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
{
ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
- RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+ RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
@@ -459,7 +459,7 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
{
- RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+ RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
@@ -478,7 +478,7 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
{
ASSERT(!structure->isUncacheableDictionary());
- RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+ RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo(), structure->anonymousSlotCount());
transition->m_dictionaryKind = kind;
transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
diff --git a/JavaScriptCore/runtime/Structure.h b/JavaScriptCore/runtime/Structure.h
index f73f9b8..d9f1411 100644
--- a/JavaScriptCore/runtime/Structure.h
+++ b/JavaScriptCore/runtime/Structure.h
@@ -147,11 +147,6 @@ namespace JSC {
void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
private:
- static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
- {
- return adoptRef(new Structure(prototype, typeInfo));
- }
-
Structure(JSValue prototype, const TypeInfo&);
typedef enum {
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 3b7de24..22732f9 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-01-29 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Darin Adler.
+
+ JSC is failing to propagate anonymous slot count on some transitions
+ https://bugs.webkit.org/show_bug.cgi?id=34321
+
+ Add a test for modification of a type with anonymous slots.
+
+ * fast/dom/Window/anonymous-slot-with-changes-expected.txt: Added.
+ * fast/dom/Window/anonymous-slot-with-changes.html: Added.
+
2010-01-29 Philippe Normand <pnormand at igalia.com>
Unreviewed, build fix.
diff --git a/LayoutTests/fast/dom/Window/anonymous-slot-with-changes-expected.txt b/LayoutTests/fast/dom/Window/anonymous-slot-with-changes-expected.txt
new file mode 100644
index 0000000..bc04a1e
--- /dev/null
+++ b/LayoutTests/fast/dom/Window/anonymous-slot-with-changes-expected.txt
@@ -0,0 +1,15 @@
+Tests that we clone object hierarchies
+PASS: eventData is null of type object
+PASS: eventData is undefined of type undefined
+PASS: eventData is 1 of type number
+PASS: eventData is true of type boolean
+PASS: eventData is 1 of type string
+PASS: eventData is [object Object] of type object
+PASS: eventData is [object Object] of type object
+PASS: eventData is of type object
+PASS: eventData is 1,2,3 of type object
+PASS: eventData is ,,1 of type object
+PASS: eventData is null of type object
+PASS: eventData is 2009-02-13T23:31:30.000Z of type object
+PASS: eventData is done of type string
+
diff --git a/LayoutTests/fast/dom/Window/anonymous-slot-with-changes.html b/LayoutTests/fast/dom/Window/anonymous-slot-with-changes.html
new file mode 100644
index 0000000..a83d259
--- /dev/null
+++ b/LayoutTests/fast/dom/Window/anonymous-slot-with-changes.html
@@ -0,0 +1,118 @@
+<html>
+<head></head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<input type="file" id="fileInput"></input>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+var console = document.getElementById("console");
+
+var messages = [];
+
+function equal(actual, expected)
+{
+ if (typeof actual !== typeof expected)
+ return false;
+ if (actual === expected)
+ return true;
+ if ((actual instanceof Date) || (expected instanceof Date)) {
+ if ((actual instanceof Date) && (expected instanceof Date))
+ return (expected instanceof Date) && actual.getTime() == expected.getTime();
+ return false;
+ }
+ if (Array.isArray(actual) || Array.isArray(expected)) {
+ if (!Array.isArray(actual) || !Array.isArray(expected))
+ return false;
+ if (actual.length != expected.length)
+ return false;
+ for (var i = 0; i < actual.length; i++) {
+ if ((i in actual) ^ (i in expected))
+ return false;
+ if (!equal(actual[i], expected[i]))
+ return false;
+ }
+ return true;
+ }
+ if (actual.constructor !== expected.constructor)
+ return false;
+ var keys = Object.keys(actual);
+ if (!equal(keys, Object.keys(expected)))
+ return false;
+ for (var i = 0; i < keys.length; i++) {
+ if (!equal(actual[keys[i]], expected[keys[i]]))
+ return false;
+ }
+ return true;
+}
+
+function safeToString(o) {
+ if (o instanceof Date)
+ return o.toISOString();
+ if (typeof o !== "object" || !o)
+ return o;
+ try {
+ return o.toString();
+ } catch (e) {
+ return Object.prototype.toString.call(o) + "(default toString threw "+e+")";
+ }
+}
+
+function shouldBe(actual, expected)
+{
+ var actualValue = eval(actual);
+ var expectedValue = eval(expected);
+ if (equal(actualValue, expectedValue))
+ console.innerHTML += "PASS: " + actual + " is " + safeToString(expectedValue) + " of type " + typeof actualValue + "<br>";
+ else
+ console.innerHTML += "FAIL: " + actual + " is " + actualValue + " should be " + expectedValue + " of type " + typeof expectedValue + "<br>";
+}
+
+function onmessage(evt) {
+ evt.foo = "bar"; // add a property.
+ eventData = evt.data;
+ shouldBe("eventData", messages.shift());
+
+ if (safeToString(evt.data) == 'done' && window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+window.addEventListener('message', onmessage, false);
+
+function tryPostMessage(message, shouldThrow, expected) {
+ try {
+ var value = eval(message);
+ postMessage(value, "*");
+ if (shouldThrow)
+ console.innerHTML += "FAIL: 'postMessage("+message+")' should throw but didn't<br>";
+ messages.push(expected || message);
+ } catch(e) {
+ if (shouldThrow)
+ console.innerHTML += "PASS: 'postMessage("+message+")' threw " + e + "<br>";
+ else
+ console.innerHTML += "FAIL: 'postMessage("+message+")' should not throw but threw " + e + "<br>";
+ }
+}
+
+document.getElementById("description").innerHTML = "Tests that we clone object hierarchies";
+
+tryPostMessage('null');
+tryPostMessage('undefined');
+tryPostMessage('1');
+tryPostMessage('true');
+tryPostMessage('"1"');
+tryPostMessage('({})');
+tryPostMessage('({a:1})');
+tryPostMessage('[]');
+tryPostMessage('[1,2,3]');
+tryPostMessage('[,,1]');
+tryPostMessage('(function(){})', false, 'null');
+tryPostMessage('new Date(1234567890000)');
+tryPostMessage('"done"');
+</script>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 40211e9..227fcc2 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-01-29 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Darin Adler.
+
+ JSC is failing to propagate anonymous slot count on some transitions
+ https://bugs.webkit.org/show_bug.cgi?id=34321
+
+ Make code generator add assertions for anonymous slot count.
+
+ Test: fast/dom/Window/anonymous-slot-with-changes.html
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+
2010-01-29 Tony Chang <tony at chromium.org>
Reviewed by Darin Adler.
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 7a55a3d..ed5293e 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1185,6 +1185,7 @@ sub GenerateImplementation
}
}
push(@implContent, "{\n");
+ push(@implContent, " ASSERT(static_cast<int>(this->structure()->anonymousSlotCount()) >= static_cast<int>(AnonymousSlotCount));\n");
if ($numCachedAttributes > 0) {
push(@implContent, " for (unsigned i = Base::AnonymousSlotCount; i < AnonymousSlotCount; i++)\n");
push(@implContent, " putAnonymousValue(i, JSValue());\n");
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list