Diff
Modified: trunk/LayoutTests/ChangeLog (168372 => 168373)
--- trunk/LayoutTests/ChangeLog 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/LayoutTests/ChangeLog 2014-05-06 19:15:42 UTC (rev 168373)
@@ -1,3 +1,17 @@
+2014-05-06 Mark Hahnenberg <mhahnenb...@apple.com>
+
+ Roll out r167889
+
+ Rubber stamped by Geoff Garen.
+
+ It broke some websites.
+
+ * js/regress/delete-a-few-properties-then-get-by-id-expected.txt:
+ * js/regress/delete-a-few-properties-then-get-by-id.html:
+ * js/regress/script-tests/delete-a-few-properties-then-get-by-id.js:
+ (MyObject): Deleted.
+ (foo): Deleted.
+
2014-05-06 Lorenzo Tilve <lti...@igalia.com>
[GTK] Unreviewed GTK gardening
Deleted: trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id-expected.txt (168372 => 168373)
--- trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id-expected.txt 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id-expected.txt 2014-05-06 19:15:42 UTC (rev 168373)
@@ -1,10 +0,0 @@
-JSRegress/delete-a-few-properties-then-get-by-id
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
Deleted: trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id.html (168372 => 168373)
--- trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id.html 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id.html 2014-05-06 19:15:42 UTC (rev 168373)
@@ -1,12 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src=""
-</head>
-<body>
-<script src=""
-<script src=""
-<script src=""
-<script src=""
-</body>
-</html>
Deleted: trunk/LayoutTests/js/regress/script-tests/delete-a-few-properties-then-get-by-id.js (168372 => 168373)
--- trunk/LayoutTests/js/regress/script-tests/delete-a-few-properties-then-get-by-id.js 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/LayoutTests/js/regress/script-tests/delete-a-few-properties-then-get-by-id.js 2014-05-06 19:15:42 UTC (rev 168373)
@@ -1,21 +0,0 @@
-function MyObject(x, y) {
- this.x = x;
- this.y = y;
- this.deleteMe = "delete me";
-}
-
-function foo(o) {
- return o.x + o.y;
-}
-
-var niters = 100000;
-var sum = 0;
-var o = new MyObject(13, 42);
-delete o.deleteMe;
-
-for (var i = 0; i < niters; ++i) {
- sum += foo(o);
-}
-
-if (sum != 55 * niters)
- throw new Error("Bad result!");
Modified: trunk/Source/_javascript_Core/ChangeLog (168372 => 168373)
--- trunk/Source/_javascript_Core/ChangeLog 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-05-06 19:15:42 UTC (rev 168373)
@@ -1,3 +1,38 @@
+2014-05-06 Mark Hahnenberg <mhahnenb...@apple.com>
+
+ Roll out r167889
+
+ Rubber stamped by Geoff Garen.
+
+ It broke some websites.
+
+ * runtime/JSPropertyNameIterator.cpp:
+ (JSC::JSPropertyNameIterator::create):
+ * runtime/PropertyMapHashTable.h:
+ (JSC::PropertyTable::hasDeletedOffset):
+ (JSC::PropertyTable::hadDeletedOffset): Deleted.
+ * runtime/Structure.cpp:
+ (JSC::Structure::Structure):
+ (JSC::Structure::materializePropertyMap):
+ (JSC::Structure::removePropertyTransition):
+ (JSC::Structure::changePrototypeTransition):
+ (JSC::Structure::despecifyFunctionTransition):
+ (JSC::Structure::attributeChangeTransition):
+ (JSC::Structure::toDictionaryTransition):
+ (JSC::Structure::preventExtensionsTransition):
+ (JSC::Structure::addPropertyWithoutTransition):
+ (JSC::Structure::removePropertyWithoutTransition):
+ (JSC::Structure::pin):
+ (JSC::Structure::pinAndPreventTransitions): Deleted.
+ * runtime/Structure.h:
+ * runtime/StructureInlines.h:
+ (JSC::Structure::setEnumerationCache):
+ (JSC::Structure::propertyTable):
+ (JSC::Structure::checkOffsetConsistency):
+ (JSC::Structure::hadDeletedOffsets): Deleted.
+ * tests/stress/for-in-after-delete.js:
+ (foo): Deleted.
+
2014-05-05 Andreas Kling <akl...@apple.com>
Fix debug build.
Modified: trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp (168372 => 168373)
--- trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp 2014-05-06 19:15:42 UTC (rev 168373)
@@ -57,14 +57,13 @@
o->methodTable()->getPropertyNames(o, exec, propertyNames, ExcludeDontEnumProperties);
size_t numCacheableSlots = 0;
if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasGetterSetterProperties()
- && !o->structure()->isUncacheableDictionary() && !o->structure()->hadDeletedOffsets() && !o->structure()->typeInfo().overridesGetPropertyNames())
+ && !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
numCacheableSlots = propertyNames.numCacheableSlots();
JSPropertyNameIterator* jsPropertyNameIterator = new (NotNull, allocateCell<JSPropertyNameIterator>(vm.heap)) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
jsPropertyNameIterator->finishCreation(vm, propertyNames.data(), o);
- // JSPropertyNameIterator doesn't know how to skip deleted buckets, so just give up.
- if (o->structure()->isDictionary() || o->structure()->hadDeletedOffsets())
+ if (o->structure()->isDictionary())
return jsPropertyNameIterator;
if (o->structure()->typeInfo().overridesGetPropertyNames())
Modified: trunk/Source/_javascript_Core/runtime/PropertyMapHashTable.h (168372 => 168373)
--- trunk/Source/_javascript_Core/runtime/PropertyMapHashTable.h 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/runtime/PropertyMapHashTable.h 2014-05-06 19:15:42 UTC (rev 168373)
@@ -189,8 +189,7 @@
// Used to maintain a list of unused entries in the property storage.
void clearDeletedOffsets();
- bool hasDeletedOffset() const;
- bool hadDeletedOffset() const; // Returns true if we ever had deleted properties.
+ bool hasDeletedOffset();
PropertyOffset getDeletedOffset();
void addDeletedOffset(PropertyOffset);
@@ -468,16 +467,11 @@
m_deletedOffsets.clear();
}
-inline bool PropertyTable::hasDeletedOffset() const
+inline bool PropertyTable::hasDeletedOffset()
{
return m_deletedOffsets && !m_deletedOffsets->isEmpty();
}
-inline bool PropertyTable::hadDeletedOffset() const
-{
- return m_deletedOffsets;
-}
-
inline PropertyOffset PropertyTable::getDeletedOffset()
{
PropertyOffset offset = m_deletedOffsets->last();
Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (168372 => 168373)
--- trunk/Source/_javascript_Core/runtime/Structure.cpp 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp 2014-05-06 19:15:42 UTC (rev 168373)
@@ -165,7 +165,6 @@
, m_transitionWatchpointSet(IsWatched)
, m_offset(invalidOffset)
, m_inlineCapacity(inlineCapacity)
- , m_forgivenDeletes(0)
, m_dictionaryKind(NoneDictionaryKind)
, m_isPinnedPropertyTable(false)
, m_hasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties(vm))
@@ -193,7 +192,6 @@
, m_transitionWatchpointSet(IsWatched)
, m_offset(invalidOffset)
, m_inlineCapacity(0)
- , m_forgivenDeletes(0)
, m_dictionaryKind(NoneDictionaryKind)
, m_isPinnedPropertyTable(false)
, m_hasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties(vm))
@@ -220,7 +218,6 @@
, m_transitionWatchpointSet(IsWatched)
, m_offset(invalidOffset)
, m_inlineCapacity(previous->m_inlineCapacity)
- , m_forgivenDeletes(previous->m_forgivenDeletes)
, m_dictionaryKind(previous->m_dictionaryKind)
, m_isPinnedPropertyTable(false)
, m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
@@ -313,12 +310,7 @@
structure = structures[i];
if (!structure->m_nameInPrevious)
continue;
-
- PropertyMapEntry entry(vm, this,
- structure->m_nameInPrevious.get(),
- propertyTable()->nextOffset(m_inlineCapacity),
- structure->m_attributesInPrevious,
- structure->m_specificValueInPrevious.get());
+ PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
}
@@ -466,26 +458,10 @@
{
ASSERT(!structure->isUncacheableDictionary());
- if (structure->m_forgivenDeletes < s_maxForgivenDeletes) {
- Structure* transition = create(vm, structure);
- ASSERT(!transition->enumerationCache());
-
- DeferGC deferGC(vm.heap);
- structure->materializePropertyMapIfNecessary(vm, deferGC);
- transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
- transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
-
- offset = transition->remove(propertyName);
- ASSERT(offset != invalidOffset);
- transition->m_forgivenDeletes = structure->m_forgivenDeletes + 1;
-
- transition->checkOffsetConsistency();
- return transition;
- }
-
Structure* transition = toUncacheableDictionaryTransition(vm, structure);
+
offset = transition->remove(propertyName);
+
transition->checkOffsetConsistency();
return transition;
}
@@ -500,7 +476,7 @@
structure->materializePropertyMapIfNecessary(vm, deferGC);
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
+ transition->pin();
transition->checkOffsetConsistency();
return transition;
@@ -517,7 +493,7 @@
structure->materializePropertyMapIfNecessary(vm, deferGC);
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
+ transition->pin();
if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
transition->despecifyAllFunctions(vm);
@@ -539,7 +515,7 @@
structure->materializePropertyMapIfNecessary(vm, deferGC);
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
+ transition->pin();
structure = transition;
}
@@ -564,7 +540,7 @@
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
transition->m_dictionaryKind = kind;
- transition->pinAndPreventTransitions();
+ transition->pin();
transition->checkOffsetConsistency();
return transition;
@@ -627,7 +603,7 @@
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
transition->m_preventExtensions = true;
- transition->pinAndPreventTransitions();
+ transition->pin();
transition->checkOffsetConsistency();
return transition;
@@ -776,7 +752,7 @@
DeferGC deferGC(vm.heap);
materializePropertyMapIfNecessaryForPinning(vm, deferGC);
- pinAndPreventTransitions();
+ pin();
return putSpecificValue(vm, propertyName, attributes, specificValue);
}
@@ -789,7 +765,7 @@
DeferGC deferGC(vm.heap);
materializePropertyMapIfNecessaryForPinning(vm, deferGC);
- pinAndPreventTransitions();
+ pin();
return remove(propertyName);
}
@@ -797,11 +773,6 @@
{
ASSERT(propertyTable());
m_isPinnedPropertyTable = true;
-}
-
-void Structure::pinAndPreventTransitions()
-{
- pin();
clearPreviousID();
m_nameInPrevious.clear();
}
Modified: trunk/Source/_javascript_Core/runtime/Structure.h (168372 => 168373)
--- trunk/Source/_javascript_Core/runtime/Structure.h 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/runtime/Structure.h 2014-05-06 19:15:42 UTC (rev 168373)
@@ -143,8 +143,6 @@
PropertyOffset removePropertyWithoutTransition(VM&, PropertyName);
void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
- bool hadDeletedOffsets() const;
-
bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
@@ -419,7 +417,6 @@
void despecifyAllFunctions(VM&);
WriteBarrier<PropertyTable>& propertyTable();
- const WriteBarrier<PropertyTable>& propertyTable() const;
PropertyTable* takePropertyTableOrCloneIfPinned(VM&, Structure* owner);
PropertyTable* copyPropertyTable(VM&, Structure* owner);
PropertyTable* copyPropertyTableForPinning(VM&, Structure* owner);
@@ -466,7 +463,6 @@
bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
void pin();
- void pinAndPreventTransitions();
Structure* previous() const
{
@@ -522,9 +518,6 @@
ConcurrentJITLock m_lock;
- static const unsigned s_maxForgivenDeletes = 5;
- unsigned m_forgivenDeletes;
-
unsigned m_dictionaryKind : 2;
bool m_isPinnedPropertyTable : 1;
bool m_hasGetterSetterProperties : 1;
Modified: trunk/Source/_javascript_Core/runtime/StructureInlines.h (168372 => 168373)
--- trunk/Source/_javascript_Core/runtime/StructureInlines.h 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/runtime/StructureInlines.h 2014-05-06 19:15:42 UTC (rev 168373)
@@ -135,7 +135,6 @@
inline void Structure::setEnumerationCache(VM& vm, JSPropertyNameIterator* enumerationCache)
{
ASSERT(!isDictionary());
- ASSERT(!hadDeletedOffsets());
if (!typeInfo().structureHasRareData())
allocateRareData(vm);
rareData()->setEnumerationCache(vm, this, enumerationCache);
@@ -218,21 +217,8 @@
return propertyTable()->size() == totalStorageCapacity();
}
-inline bool Structure::hadDeletedOffsets() const
+ALWAYS_INLINE WriteBarrier<PropertyTable>& Structure::propertyTable()
{
- // If we had deleted anything then we would have pinned our property table.
- if (!propertyTable())
- return false;
- return propertyTable()->hadDeletedOffset();
-}
-
-inline WriteBarrier<PropertyTable>& Structure::propertyTable()
-{
- return const_cast<WriteBarrier<PropertyTable>&>(static_cast<const Structure*>(this)->propertyTable());
-}
-
-inline const WriteBarrier<PropertyTable>& Structure::propertyTable() const
-{
ASSERT(!globalObject() || !globalObject()->vm().heap.isCollecting());
return m_propertyTableUnsafe;
}
@@ -253,8 +239,8 @@
if (isCompilationThread())
return true;
+ RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize());
unsigned totalSize = propertyTable->propertyStorageSize();
- RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == totalSize);
RELEASE_ASSERT((totalSize < inlineCapacity() ? 0 : totalSize - inlineCapacity()) == numberOfOutOfLineSlotsForLastOffset(m_offset));
return true;
Deleted: trunk/Source/_javascript_Core/tests/stress/for-in-after-delete.js (168372 => 168373)
--- trunk/Source/_javascript_Core/tests/stress/for-in-after-delete.js 2014-05-06 19:14:19 UTC (rev 168372)
+++ trunk/Source/_javascript_Core/tests/stress/for-in-after-delete.js 2014-05-06 19:15:42 UTC (rev 168373)
@@ -1,21 +0,0 @@
-var foo = function() {
- var o = {};
- o.x = "foo";
- o.y = 1;
-
- delete o.x;
-
- o.z = 2;
-
- var result = null;
- var i = 0;
- for (var p in o) {
- if (result === null)
- result = o[p];
- }
-
- if (result !== 1)
- throw new Error("Incorrect result: " + result + " (expected 1)");
-};
-
-foo();
