Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (153656 => 153657)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-02 18:27:51 UTC (rev 153657)
@@ -1,3 +1,39 @@
+2013-08-01 Filip Pizlo <fpi...@apple.com>
+
+ hasIndexingHeader should be a property of the Structure, not just the IndexingType
+ https://bugs.webkit.org/show_bug.cgi?id=119422
+
+ Reviewed by Oliver Hunt.
+
+ This simplifies some code and also allows Structure to claim that an object
+ has an indexing header even if it doesn't have indexed properties.
+
+ I also changed some calls to use hasIndexedProperties() since in some cases,
+ that's what we actually meant. Currently the two are synonyms.
+
+ * dfg/DFGRepatch.cpp:
+ (JSC::DFG::tryCachePutByID):
+ (JSC::DFG::tryBuildPutByIdList):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+ (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+ * runtime/ButterflyInlines.h:
+ (JSC::Butterfly::create):
+ (JSC::Butterfly::growPropertyStorage):
+ (JSC::Butterfly::growArrayRight):
+ (JSC::Butterfly::resizeArray):
+ * runtime/IndexingType.h:
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::copyButterfly):
+ (JSC::JSObject::visitButterfly):
+ (JSC::JSObject::setPrototype):
+ * runtime/JSObject.h:
+ (JSC::JSObject::setButterfly):
+ * runtime/JSPropertyNameIterator.cpp:
+ (JSC::JSPropertyNameIterator::create):
+ * runtime/Structure.h:
+ (JSC::Structure::hasIndexingHeader):
+
2013-08-02 Julien Brianceau <jbrianc...@nds.com>
REGRESSION: ARM still crashes after change set r153612.
Modified: trunk/Source/_javascript_Core/dfg/DFGRepatch.cpp (153656 => 153657)
--- trunk/Source/_javascript_Core/dfg/DFGRepatch.cpp 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/dfg/DFGRepatch.cpp 2013-08-02 18:27:51 UTC (rev 153657)
@@ -965,7 +965,7 @@
// Skip optimizing the case where we need realloc, and the structure has
// indexing storage.
- if (hasIndexingHeader(oldStructure->indexingType()))
+ if (oldStructure->hasIndexingHeader())
return false;
if (normalizePrototypeChain(exec, baseCell) == InvalidPrototypeChain)
@@ -1040,7 +1040,7 @@
// Skip optimizing the case where we need realloc, and the structure has
// indexing storage.
- if (hasIndexingHeader(oldStructure->indexingType()))
+ if (oldStructure->hasIndexingHeader())
return false;
if (normalizePrototypeChain(exec, baseCell) == InvalidPrototypeChain)
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (153656 => 153657)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-08-02 18:27:51 UTC (rev 153657)
@@ -4259,7 +4259,7 @@
void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)
{
- if (hasIndexingHeader(node->structureTransitionData().previousStructure->indexingType())) {
+ if (node->structureTransitionData().previousStructure->hasIndexingHeader()) {
SpeculateCellOperand base(this, node->child1());
GPRReg baseGPR = base.gpr();
@@ -4302,7 +4302,7 @@
size_t newSize = oldSize * outOfLineGrowthFactor;
ASSERT(newSize == node->structureTransitionData().newStructure->outOfLineCapacity() * sizeof(JSValue));
- if (hasIndexingHeader(node->structureTransitionData().previousStructure->indexingType())) {
+ if (node->structureTransitionData().previousStructure->hasIndexingHeader()) {
SpeculateCellOperand base(this, node->child1());
GPRReg baseGPR = base.gpr();
Modified: trunk/Source/_javascript_Core/runtime/ButterflyInlines.h (153656 => 153657)
--- trunk/Source/_javascript_Core/runtime/ButterflyInlines.h 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/runtime/ButterflyInlines.h 2013-08-02 18:27:51 UTC (rev 153657)
@@ -58,7 +58,7 @@
{
return create(
vm, intendedOwner, 0, structure->outOfLineCapacity(),
- hasIndexingHeader(structure->indexingType()), IndexingHeader(), 0);
+ structure->hasIndexingHeader(), IndexingHeader(), 0);
}
inline Butterfly* Butterfly::createUninitializedDuringCollection(CopyVisitor& visitor, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes)
@@ -96,7 +96,7 @@
{
return growPropertyStorage(
vm, intendedOwner, indexingHeader()->preCapacity(structure), oldPropertyCapacity,
- hasIndexingHeader(structure->indexingType()),
+ structure->hasIndexingHeader(),
indexingHeader()->indexingPayloadSizeInBytes(structure), newPropertyCapacity);
}
@@ -129,7 +129,7 @@
size_t newIndexingPayloadSizeInBytes)
{
ASSERT_UNUSED(oldStructure, !indexingHeader()->preCapacity(oldStructure));
- ASSERT_UNUSED(oldStructure, hadIndexingHeader == hasIndexingHeader(oldStructure->indexingType()));
+ ASSERT_UNUSED(oldStructure, hadIndexingHeader == oldStructure->hasIndexingHeader());
void* theBase = base(0, propertyCapacity);
size_t oldSize = totalSize(0, propertyCapacity, hadIndexingHeader, oldIndexingPayloadSizeInBytes);
size_t newSize = totalSize(0, propertyCapacity, true, newIndexingPayloadSizeInBytes);
@@ -144,8 +144,9 @@
{
return growArrayRight(
vm, intendedOwner, oldStructure, oldStructure->outOfLineCapacity(),
- hasIndexingHeader(oldStructure->indexingType()),
- indexingHeader()->indexingPayloadSizeInBytes(oldStructure), newIndexingPayloadSizeInBytes);
+ oldStructure->hasIndexingHeader(),
+ indexingHeader()->indexingPayloadSizeInBytes(oldStructure),
+ newIndexingPayloadSizeInBytes);
}
inline Butterfly* Butterfly::resizeArray(
@@ -171,7 +172,7 @@
VM& vm, JSCell* intendedOwner, Structure* structure, size_t newPreCapacity,
size_t newIndexingPayloadSizeInBytes)
{
- bool hasIndexingHeader = JSC::hasIndexingHeader(structure->indexingType());
+ bool hasIndexingHeader = structure->hasIndexingHeader();
return resizeArray(
vm, intendedOwner, structure->outOfLineCapacity(), hasIndexingHeader,
indexingHeader()->indexingPayloadSizeInBytes(structure), newPreCapacity,
Modified: trunk/Source/_javascript_Core/runtime/IndexingType.h (153656 => 153657)
--- trunk/Source/_javascript_Core/runtime/IndexingType.h 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/runtime/IndexingType.h 2013-08-02 18:27:51 UTC (rev 153657)
@@ -101,11 +101,6 @@
return (indexingType & IndexingShapeMask) != NoIndexingShape;
}
-static inline bool hasIndexingHeader(IndexingType type)
-{
- return hasIndexedProperties(type);
-}
-
static inline bool hasUndecided(IndexingType indexingType)
{
return (indexingType & IndexingShapeMask) == UndecidedShape;
Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (153656 => 153657)
--- trunk/Source/_javascript_Core/runtime/JSObject.cpp 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp 2013-08-02 18:27:51 UTC (rev 153657)
@@ -102,7 +102,7 @@
size_t propertyCapacity = structure->outOfLineCapacity();
size_t preCapacity;
size_t indexingPayloadSizeInBytes;
- bool hasIndexingHeader = JSC::hasIndexingHeader(structure->indexingType());
+ bool hasIndexingHeader = structure->hasIndexingHeader();
if (UNLIKELY(hasIndexingHeader)) {
preCapacity = butterfly->indexingHeader()->preCapacity(structure);
indexingPayloadSizeInBytes = butterfly->indexingHeader()->indexingPayloadSizeInBytes(structure);
@@ -148,8 +148,8 @@
count = newButterfly->arrayStorage()->vectorLength();
break;
}
+
default:
- CRASH();
currentTarget = 0;
currentSource = 0;
count = 0;
@@ -173,7 +173,7 @@
size_t propertyCapacity = structure->outOfLineCapacity();
size_t preCapacity;
size_t indexingPayloadSizeInBytes;
- bool hasIndexingHeader = JSC::hasIndexingHeader(structure->indexingType());
+ bool hasIndexingHeader = structure->hasIndexingHeader();
if (UNLIKELY(hasIndexingHeader)) {
preCapacity = butterfly->indexingHeader()->preCapacity(structure);
indexingPayloadSizeInBytes = butterfly->indexingHeader()->indexingPayloadSizeInBytes(structure);
@@ -1146,7 +1146,7 @@
return;
}
- if (!hasIndexingHeader(structure()->indexingType()))
+ if (!hasIndexedProperties(structure()->indexingType()))
return;
if (shouldUseSlowPut(structure()->indexingType()))
Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (153656 => 153657)
--- trunk/Source/_javascript_Core/runtime/JSObject.h 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h 2013-08-02 18:27:51 UTC (rev 153657)
@@ -1107,7 +1107,7 @@
inline void JSObject::setButterfly(VM& vm, Butterfly* butterfly, Structure* structure)
{
ASSERT(structure);
- ASSERT(!butterfly == (!structure->outOfLineCapacity() && !hasIndexingHeader(structure->indexingType())));
+ ASSERT(!butterfly == (!structure->outOfLineCapacity() && !structure->hasIndexingHeader()));
setStructure(vm, structure);
m_butterfly = butterfly;
}
Modified: trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp (153656 => 153657)
--- trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp 2013-08-02 18:27:51 UTC (rev 153657)
@@ -65,7 +65,7 @@
if (o->structure()->typeInfo().overridesGetPropertyNames())
return jsPropertyNameIterator;
- if (hasIndexingHeader(o->structure()->indexingType()))
+ if (hasIndexedProperties(o->structure()->indexingType()))
return jsPropertyNameIterator;
size_t count = normalizePrototypeChain(exec, o);
Modified: trunk/Source/_javascript_Core/runtime/Structure.h (153656 => 153657)
--- trunk/Source/_javascript_Core/runtime/Structure.h 2013-08-02 18:16:38 UTC (rev 153656)
+++ trunk/Source/_javascript_Core/runtime/Structure.h 2013-08-02 18:27:51 UTC (rev 153657)
@@ -227,6 +227,11 @@
&& offset <= m_offset
&& (offset < m_inlineCapacity || offset >= firstOutOfLineOffset);
}
+
+ bool hasIndexingHeader() const
+ {
+ return hasIndexedProperties(indexingType());
+ }
bool masqueradesAsUndefined(JSGlobalObject* lexicalGlobalObject);
