Title: [204093] trunk
- Revision
- 204093
- Author
- [email protected]
- Date
- 2016-08-03 11:50:57 -0700 (Wed, 03 Aug 2016)
Log Message
REGRESSION(r203368): broke some test262 tests
https://bugs.webkit.org/show_bug.cgi?id=160479
Reviewed by Mark Lam.
JSTests:
Added a stress test for this case, since we don't always run test262.
* stress/freeze-setter.js: Added.
(let.o.set foo):
Source/_javascript_Core:
The optimization in r203368 overlooked a subtle detail: freezing should not set ReadOnly on
Accessor properties.
* runtime/Structure.cpp:
(JSC::Structure::nonPropertyTransition):
* runtime/StructureTransitionTable.h:
(JSC::setsDontDeleteOnAllProperties):
(JSC::setsReadOnlyOnNonAccessorProperties):
(JSC::setsReadOnlyOnAllProperties): Deleted.
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (204092 => 204093)
--- trunk/JSTests/ChangeLog 2016-08-03 18:44:04 UTC (rev 204092)
+++ trunk/JSTests/ChangeLog 2016-08-03 18:50:57 UTC (rev 204093)
@@ -1,3 +1,15 @@
+2016-08-03 Filip Pizlo <[email protected]>
+
+ REGRESSION(r203368): broke some test262 tests
+ https://bugs.webkit.org/show_bug.cgi?id=160479
+
+ Reviewed by Mark Lam.
+
+ Added a stress test for this case, since we don't always run test262.
+
+ * stress/freeze-setter.js: Added.
+ (let.o.set foo):
+
2016-08-03 Saam Barati <[email protected]>
Implement nested rest destructuring w.r.t the ES7 spec
Added: trunk/JSTests/stress/freeze-setter.js (0 => 204093)
--- trunk/JSTests/stress/freeze-setter.js (rev 0)
+++ trunk/JSTests/stress/freeze-setter.js 2016-08-03 18:50:57 UTC (rev 204093)
@@ -0,0 +1,20 @@
+//@ runDefault
+
+"use strict";
+
+let x;
+
+let o = {
+ set foo(value)
+ {
+ x = value;
+ }
+};
+
+Object.freeze(o);
+
+o.foo = 42;
+
+if (x != 42)
+ throw "Error: bad result: " + x;
+
Modified: trunk/Source/_javascript_Core/ChangeLog (204092 => 204093)
--- trunk/Source/_javascript_Core/ChangeLog 2016-08-03 18:44:04 UTC (rev 204092)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-08-03 18:50:57 UTC (rev 204093)
@@ -1,3 +1,20 @@
+2016-08-03 Filip Pizlo <[email protected]>
+
+ REGRESSION(r203368): broke some test262 tests
+ https://bugs.webkit.org/show_bug.cgi?id=160479
+
+ Reviewed by Mark Lam.
+
+ The optimization in r203368 overlooked a subtle detail: freezing should not set ReadOnly on
+ Accessor properties.
+
+ * runtime/Structure.cpp:
+ (JSC::Structure::nonPropertyTransition):
+ * runtime/StructureTransitionTable.h:
+ (JSC::setsDontDeleteOnAllProperties):
+ (JSC::setsReadOnlyOnNonAccessorProperties):
+ (JSC::setsReadOnlyOnAllProperties): Deleted.
+
2016-08-03 Csaba Osztrogonác <[email protected]>
Lacking support on a arm-traditional disassembler.
Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (204092 => 204093)
--- trunk/Source/_javascript_Core/runtime/Structure.cpp 2016-08-03 18:44:04 UTC (rev 204092)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp 2016-08-03 18:50:57 UTC (rev 204093)
@@ -652,12 +652,8 @@
if (preventsExtensions(transitionKind))
transition->setDidPreventExtensions(true);
- unsigned additionalPropertyAttributes = 0;
- if (setsDontDeleteOnAllProperties(transitionKind))
- additionalPropertyAttributes |= DontDelete;
- if (setsReadOnlyOnAllProperties(transitionKind))
- additionalPropertyAttributes |= ReadOnly;
- if (additionalPropertyAttributes) {
+ if (setsDontDeleteOnAllProperties(transitionKind)
+ || setsReadOnlyOnNonAccessorProperties(transitionKind)) {
// We pin the property table on transitions that do wholesale editing of the property
// table, since our logic for walking the property transition chain to rematerialize the
// table doesn't know how to take into account such wholesale edits.
@@ -668,8 +664,12 @@
transition->pinForCaching();
if (transition->propertyTable()) {
- for (auto& entry : *transition->propertyTable().get())
- entry.attributes |= additionalPropertyAttributes;
+ for (auto& entry : *transition->propertyTable().get()) {
+ if (setsDontDeleteOnAllProperties(transitionKind))
+ entry.attributes |= DontDelete;
+ if (setsReadOnlyOnNonAccessorProperties(transitionKind) && !(entry.attributes & Accessor))
+ entry.attributes |= ReadOnly;
+ }
}
} else {
transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
@@ -677,7 +677,7 @@
checkOffset(transition->m_offset, transition->inlineCapacity());
}
- if (setsReadOnlyOnAllProperties(transitionKind)
+ if (setsReadOnlyOnNonAccessorProperties(transitionKind)
&& transition->propertyTable()
&& !transition->propertyTable()->isEmpty())
transition->setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
Modified: trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h (204092 => 204093)
--- trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h 2016-08-03 18:44:04 UTC (rev 204092)
+++ trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h 2016-08-03 18:50:57 UTC (rev 204093)
@@ -130,7 +130,7 @@
}
}
-inline bool setsReadOnlyOnAllProperties(NonPropertyTransition transition)
+inline bool setsReadOnlyOnNonAccessorProperties(NonPropertyTransition transition)
{
switch (transition) {
case NonPropertyTransition::Freeze:
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
