[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.22-985-g3c00f00
oliver at apple.com
oliver at apple.com
Wed Mar 17 17:58:33 UTC 2010
The following commit has been merged in the webkit-1.1 branch:
commit a9d8f6099695158505348dc9836605611ad3e38b
Author: oliver at apple.com <oliver at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Wed Feb 24 21:20:42 2010 +0000
2010-02-24 Oliver Hunt <oliver at apple.com>
Reviewed by Geoffrey Garen.
[REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
https://bugs.webkit.org/show_bug.cgi?id=35335
compileGetDirectOffset modifies the contents of the object register
when the object is not using the inline storage array. As the object
register contains our 'this' pointer we can't allow it to be clobbered.
The fix is simply to copy the register into a separate scratch register
when we're loading off an object that doesn't use inline storage.
* jit/JITPropertyAccess.cpp:
(JSC::JIT::privateCompileGetByIdSelfList):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::privateCompileGetByIdSelfList):
2010-02-24 Oliver Hunt <oliver at apple.com>
Reviewed by Geoffrey Garen.
[REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
https://bugs.webkit.org/show_bug.cgi?id=35335
Add tests for caching getter lookup on large objects (eg. those not
using the inline storage array).
* fast/js/pic/cached-getter-setter-expected.txt:
* fast/js/pic/cached-getter-setter.html:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55198 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 877606c..4a136db 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,5 +1,23 @@
2010-02-24 Oliver Hunt <oliver at apple.com>
+ Reviewed by Geoffrey Garen.
+
+ [REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
+ https://bugs.webkit.org/show_bug.cgi?id=35335
+
+ compileGetDirectOffset modifies the contents of the object register
+ when the object is not using the inline storage array. As the object
+ register contains our 'this' pointer we can't allow it to be clobbered.
+ The fix is simply to copy the register into a separate scratch register
+ when we're loading off an object that doesn't use inline storage.
+
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::privateCompileGetByIdSelfList):
+ * jit/JITPropertyAccess32_64.cpp:
+ (JSC::JIT::privateCompileGetByIdSelfList):
+
+2010-02-24 Oliver Hunt <oliver at apple.com>
+
Reviewed by Gavin Barraclough.
Speed up getter performance in the jit
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 4d3c612..8f1ddbb 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -758,7 +758,11 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
{
Jump failureCase = checkStructure(regT0, structure);
if (isGetter) {
- compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
+ if (!structure->isUsingInlineStorage()) {
+ move(regT0, regT1);
+ compileGetDirectOffset(regT1, regT1, structure, cachedOffset);
+ } else
+ compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
stubCall.addArgument(regT1);
stubCall.addArgument(regT0);
diff --git a/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index c871579..d1bb449 100644
--- a/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -786,7 +786,11 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
// regT0 holds a JSCell*
Jump failureCase = checkStructure(regT0, structure);
if (isGetter) {
- compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
+ if (!structure->isUsingInlineStorage()) {
+ move(regT0, regT1);
+ compileGetDirectOffset(regT1, regT2, regT1, structure, cachedOffset);
+ } else
+ compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
stubCall.addArgument(regT1);
stubCall.addArgument(regT0);
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 5d49f17..bdc7066 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2010-02-24 Oliver Hunt <oliver at apple.com>
+
+ Reviewed by Geoffrey Garen.
+
+ [REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
+ https://bugs.webkit.org/show_bug.cgi?id=35335
+
+ Add tests for caching getter lookup on large objects (eg. those not
+ using the inline storage array).
+
+ * fast/js/pic/cached-getter-setter-expected.txt:
+ * fast/js/pic/cached-getter-setter.html:
+
2010-02-24 Xan Lopez <xlopez at igalia.com>
Reviewed by Gustavo Noronha.
diff --git a/LayoutTests/fast/js/pic/cached-getter-setter-expected.txt b/LayoutTests/fast/js/pic/cached-getter-setter-expected.txt
index 99c5019..d35c133 100644
--- a/LayoutTests/fast/js/pic/cached-getter-setter-expected.txt
+++ b/LayoutTests/fast/js/pic/cached-getter-setter-expected.txt
@@ -15,6 +15,15 @@ PASS: testProtoGetter({__proto__: {count: 'FAIL', get getter(){ return ++this.co
PASS: testProtoChainGetter({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }}}, count: 0}) should be 10 and is.
PASS: testProtoChainGetter({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }}}, count: 0, newProperty: 0}) should be 10 and is.
PASS: testProtoChainGetter({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }}}, count: 0, newProperty2: 0}) should be 10 and is.
+PASS: testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}) should be 10 and is.
+PASS: testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, newProperty: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}) should be 10 and is.
+PASS: testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, newProperty2: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}) should be 10 and is.
+PASS: testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0}) should be 10 and is.
+PASS: testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0, newProperty: 0}) should be 10 and is.
+PASS: testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0, newProperty2: 0}) should be 10 and is.
+PASS: testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0}) should be 10 and is.
+PASS: testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0, newProperty: 0}) should be 10 and is.
+PASS: testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0, newProperty2: 0}) should be 10 and is.
PASS: getX(o) should be 3 and is.
PASS: getX(o) should be 3 and is.
diff --git a/LayoutTests/fast/js/pic/cached-getter-setter.html b/LayoutTests/fast/js/pic/cached-getter-setter.html
index f4494f1..909ede9 100644
--- a/LayoutTests/fast/js/pic/cached-getter-setter.html
+++ b/LayoutTests/fast/js/pic/cached-getter-setter.html
@@ -89,6 +89,43 @@ you'll see a series of PASS messages below.
shouldBe(testProtoChainGetter({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }}}, count: 0, newProperty2: 0}),
"testProtoChainGetter({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }}}, count: 0, newProperty2: 0})", 10);
+ function testGetterBigObject(o) {
+ var result;
+ for (var i = 0; i < 10; i++)
+ result = o.getter;
+ return result;
+ }
+ function testProtoGetterBigObject(o) {
+ var result;
+ for (var i = 0; i < 10; i++)
+ result = o.getter;
+ return result;
+ }
+ function testProtoChainGetterBigObject(o) {
+ var result;
+ for (var i = 0; i < 10; i++)
+ result = o.getter;
+ return result;
+ }
+ shouldBe(testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}),
+ "testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9})", 10);
+ shouldBe(testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, newProperty: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}),
+ "testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, newProperty: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9})", 10);
+ shouldBe(testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, newProperty2: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}),
+ "testGetterBigObject({__proto__: {count: 'FAIL'}, get getter(){ return ++this.count; }, count: 0, newProperty2: 0, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9})", 10);
+ shouldBe(testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0}),
+ "testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0})", 10);
+ shouldBe(testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0, newProperty: 0}),
+ "testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0, newProperty: 0})", 10);
+ shouldBe(testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0, newProperty2: 0}),
+ "testProtoGetterBigObject({__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}, count: 0, newProperty2: 0})", 10);
+ shouldBe(testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0}),
+ "testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0})", 10);
+ shouldBe(testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0, newProperty: 0}),
+ "testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0, newProperty: 0})", 10);
+ shouldBe(testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0, newProperty2: 0}),
+ "testProtoChainGetterBigObject({__proto__: {__proto__: {count: 'FAIL', get getter(){ return ++this.count; }, a:1, b:2, c:3, d: 4, e: 5, f: 6, g: 7, h: 8, i: 9}}, count: 0, newProperty2: 0})", 10);
+
(function() {
var o = {
x : 1,
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list