Title: [177030] trunk
Revision
177030
Author
msab...@apple.com
Date
2014-12-09 11:52:40 -0800 (Tue, 09 Dec 2014)

Log Message

DFG Tries using an inner object's getter/setter when one hasn't been defined
https://bugs.webkit.org/show_bug.cgi?id=139229

Reviewed by Filip Pizlo.

Source/_javascript_Core:

Added a new NullGetterFunction singleton class to use for getters and setters that
haven't been set to a user defined value.  The NullGetterFunction callReturnUndefined()
and createReturnUndefined() methods return undefined.  Changed all null checks of the
getter and setter pointers to the newly added isGetterNull() and isSetterNull()
helper methods.  

* CMakeLists.txt:
* _javascript_Core.vcxproj/_javascript_Core.vcxproj:
* _javascript_Core.vcxproj/_javascript_Core.vcxproj.filters:
* _javascript_Core.xcodeproj/project.pbxproj:
Added NullGetterFunction.cpp & .h to build files.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::setDescriptor):
(JSC::PropertyDescriptor::setAccessorDescriptor):
Changed checking getter and setter to null to use new isGetterNull() and isSetterNull()
helpers.

* inspector/JSInjectedScriptHostPrototype.cpp:
(Inspector::JSInjectedScriptHostPrototype::finishCreation):
* inspector/JSJavaScriptCallFramePrototype.cpp:
* jit/JITOperations.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/JSObject.cpp:
(JSC::JSObject::putIndexedDescriptor):
(JSC::putDescriptor):
(JSC::JSObject::defineOwnNonIndexProperty):
* runtime/MapPrototype.cpp:
(JSC::MapPrototype::finishCreation):
* runtime/SetPrototype.cpp:
(JSC::SetPrototype::finishCreation):
Updated calls to GetterSetter::create(), setGetter(), setSetter(), withGetter()
and withSetter() to provide a global object.

* runtime/GetterSetter.cpp:
(JSC::GetterSetter::withGetter):
(JSC::GetterSetter::withSetter):
(JSC::callGetter):
(JSC::callSetter):
* runtime/GetterSetter.h:
(JSC::GetterSetter::GetterSetter):
(JSC::GetterSetter::create):
(JSC::GetterSetter::isGetterNull):
(JSC::GetterSetter::isSetterNull):
(JSC::GetterSetter::setGetter):
(JSC::GetterSetter::setSetter):
Changed to use NullGetterFunction for unspecified getters / setters.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::createThrowTypeError):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::nullGetterFunction):
(JSC::JSGlobalObject::evalFunction):
Added m_nullGetterFunction singleton.  Updated calls to GetterSetter::create(),
setGetter() and setSetter() to provide a global object.

* runtime/NullGetterFunction.cpp: Added.
(JSC::callReturnUndefined):
(JSC::constructReturnUndefined):
(JSC::NullGetterFunction::getCallData):
(JSC::NullGetterFunction::getConstructData):
* runtime/NullGetterFunction.h: Added.
(JSC::NullGetterFunction::create):
(JSC::NullGetterFunction::createStructure):
(JSC::NullGetterFunction::NullGetterFunction):
New singleton class that returns undefined when called.

LayoutTests:

New regression test.

* js/regress-139229-expected.txt: Added.
* js/regress-139229.html: Added.
* js/script-tests/regress-139229.js: Added.
(InnerObjectNoGetter):
(InnerObjectNoGetter.prototype.set enabled):
(InnerObjectNoSetter):
(InnerObjectNoSetter.prototype.get enabled):
(OuterObject):
(OuterObject.prototype.get enabled):
(OuterObject.prototype.set enabled):

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (177029 => 177030)


--- trunk/LayoutTests/ChangeLog	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/LayoutTests/ChangeLog	2014-12-09 19:52:40 UTC (rev 177030)
@@ -1,3 +1,23 @@
+2014-12-09  Michael Saboff  <msab...@apple.com>
+
+        DFG Tries using an inner object's getter/setter when one hasn't been defined
+        https://bugs.webkit.org/show_bug.cgi?id=139229
+
+        Reviewed by Filip Pizlo.
+
+        New regression test.
+
+        * js/regress-139229-expected.txt: Added.
+        * js/regress-139229.html: Added.
+        * js/script-tests/regress-139229.js: Added.
+        (InnerObjectNoGetter):
+        (InnerObjectNoGetter.prototype.set enabled):
+        (InnerObjectNoSetter):
+        (InnerObjectNoSetter.prototype.get enabled):
+        (OuterObject):
+        (OuterObject.prototype.get enabled):
+        (OuterObject.prototype.set enabled):
+
 2014-12-09  Geoffrey Garen  <gga...@apple.com>
 
         Re-enable function.arguments

Added: trunk/LayoutTests/js/regress-139229-expected.txt (0 => 177030)


--- trunk/LayoutTests/js/regress-139229-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/js/regress-139229-expected.txt	2014-12-09 19:52:40 UTC (rev 177030)
@@ -0,0 +1,9 @@
+Regression test for https://webkit.org/b/139229. This test should not crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/js/regress-139229.html (0 => 177030)


--- trunk/LayoutTests/js/regress-139229.html	                        (rev 0)
+++ trunk/LayoutTests/js/regress-139229.html	2014-12-09 19:52:40 UTC (rev 177030)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>

Added: trunk/LayoutTests/js/script-tests/regress-139229.js (0 => 177030)


--- trunk/LayoutTests/js/script-tests/regress-139229.js	                        (rev 0)
+++ trunk/LayoutTests/js/script-tests/regress-139229.js	2014-12-09 19:52:40 UTC (rev 177030)
@@ -0,0 +1,66 @@
+description(
+"Regression test for https://webkit.org/b/139229. This test should not crash."
+);
+
+function InnerObjectNoGetter()
+{
+    this._enabled = false;
+}
+
+InnerObjectNoGetter.prototype = {
+    set enabled(x)
+    {
+        this._enabled = x;
+    }
+}
+
+function InnerObjectNoSetter()
+{
+    this._enabled = false;
+}
+
+InnerObjectNoSetter.prototype = {
+    get enabled()
+    {
+        return this._enabled;
+    }
+}
+
+function OuterObject(inner)
+{
+    this._innerObject = inner;
+}
+
+OuterObject.prototype = {
+    get enabled()
+    {
+        return this._innerObject.enabled;
+    },
+
+    set enabled(x)
+    {
+        this._innerObject.enabled = x;
+    }
+}
+
+var count = 0;
+
+var innerNoGetter = new InnerObjectNoGetter;
+var outerNoInnerGetter = new OuterObject(innerNoGetter);
+
+for (var i = 0; i < 1000; ++i) {
+    if (outerNoInnerGetter.enabled)
+        ++count;
+}
+
+var innerNoSetter = new InnerObjectNoSetter;
+var outerNoInnerSetter = new OuterObject(innerNoSetter);
+
+for (var i = 0; i < 1000; ++i) {
+    outerNoInnerSetter.enabled = true;
+    if (outerNoInnerSetter.enabled)
+        ++count;
+}
+
+if (count)
+    throw "Error: bad result: count should be 0 but was: " + count;

Modified: trunk/Source/_javascript_Core/CMakeLists.txt (177029 => 177030)


--- trunk/Source/_javascript_Core/CMakeLists.txt	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/CMakeLists.txt	2014-12-09 19:52:40 UTC (rev 177030)
@@ -513,6 +513,7 @@
     runtime/NamePrototype.cpp
     runtime/NativeErrorConstructor.cpp
     runtime/NativeErrorPrototype.cpp
+    runtime/NullGetterFunction.cpp
     runtime/NumberConstructor.cpp
     runtime/NumberObject.cpp
     runtime/NumberPrototype.cpp

Modified: trunk/Source/_javascript_Core/ChangeLog (177029 => 177030)


--- trunk/Source/_javascript_Core/ChangeLog	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/ChangeLog	2014-12-09 19:52:40 UTC (rev 177030)
@@ -1,3 +1,85 @@
+2014-12-09  Michael Saboff  <msab...@apple.com>
+
+        DFG Tries using an inner object's getter/setter when one hasn't been defined
+        https://bugs.webkit.org/show_bug.cgi?id=139229
+
+        Reviewed by Filip Pizlo.
+
+        Added a new NullGetterFunction singleton class to use for getters and setters that
+        haven't been set to a user defined value.  The NullGetterFunction callReturnUndefined()
+        and createReturnUndefined() methods return undefined.  Changed all null checks of the
+        getter and setter pointers to the newly added isGetterNull() and isSetterNull()
+        helper methods.  
+
+        * CMakeLists.txt:
+        * _javascript_Core.vcxproj/_javascript_Core.vcxproj:
+        * _javascript_Core.vcxproj/_javascript_Core.vcxproj.filters:
+        * _javascript_Core.xcodeproj/project.pbxproj:
+        Added NullGetterFunction.cpp & .h to build files.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        Changed checking getter and setter to null to use new isGetterNull() and isSetterNull()
+        helpers.
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        Updated calls to GetterSetter::create(), setGetter(), setSetter(), withGetter()
+        and withSetter() to provide a global object.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::withGetter):
+        (JSC::GetterSetter::withSetter):
+        (JSC::callGetter):
+        (JSC::callSetter):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::create):
+        (JSC::GetterSetter::isGetterNull):
+        (JSC::GetterSetter::isSetterNull):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setSetter):
+        Changed to use NullGetterFunction for unspecified getters / setters.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::createThrowTypeError):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::nullGetterFunction):
+        (JSC::JSGlobalObject::evalFunction):
+        Added m_nullGetterFunction singleton.  Updated calls to GetterSetter::create(),
+        setGetter() and setSetter() to provide a global object.
+
+        * runtime/NullGetterFunction.cpp: Added.
+        (JSC::callReturnUndefined):
+        (JSC::constructReturnUndefined):
+        (JSC::NullGetterFunction::getCallData):
+        (JSC::NullGetterFunction::getConstructData):
+        * runtime/NullGetterFunction.h: Added.
+        (JSC::NullGetterFunction::create):
+        (JSC::NullGetterFunction::createStructure):
+        (JSC::NullGetterFunction::NullGetterFunction):
+        New singleton class that returns undefined when called.
+
 2014-12-09  Geoffrey Garen  <gga...@apple.com>
 
         Re-enable function.arguments

Modified: trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj (177029 => 177030)


--- trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj	2014-12-09 19:52:40 UTC (rev 177030)
@@ -778,6 +778,7 @@
     <ClCompile Include="..\runtime\NamePrototype.cpp" />
     <ClCompile Include="..\runtime\NativeErrorConstructor.cpp" />
     <ClCompile Include="..\runtime\NativeErrorPrototype.cpp" />
+    <ClCompile Include="..\runtime\NullGetterFunction.cpp" />
     <ClCompile Include="..\runtime\NumberConstructor.cpp" />
     <ClCompile Include="..\runtime\NumberObject.cpp" />
     <ClCompile Include="..\runtime\NumberPrototype.cpp" />
@@ -1571,6 +1572,7 @@
     <ClInclude Include="..\runtime\NamePrototype.h" />
     <ClInclude Include="..\runtime\NativeErrorConstructor.h" />
     <ClInclude Include="..\runtime\NativeErrorPrototype.h" />
+    <ClInclude Include="..\runtime\NullGetterFunction.h" />
     <ClInclude Include="..\runtime\NumberConstructor.h" />
     <ClInclude Include="..\runtime\NumberObject.h" />
     <ClInclude Include="..\runtime\NumberPrototype.h" />

Modified: trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj.filters (177029 => 177030)


--- trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj.filters	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj.filters	2014-12-09 19:52:40 UTC (rev 177030)
@@ -756,6 +756,9 @@
     <ClCompile Include="..\runtime\NativeErrorPrototype.cpp">
       <Filter>runtime</Filter>
     </ClCompile>
+    <ClCompile Include="..\runtime\NullGetterFunction.cpp">
+      <Filter>runtime</Filter>
+    </ClCompile>
     <ClCompile Include="..\runtime\NumberConstructor.cpp">
       <Filter>runtime</Filter>
     </ClCompile>
@@ -2768,6 +2771,9 @@
     <ClInclude Include="..\runtime\NativeErrorPrototype.h">
       <Filter>runtime</Filter>
     </ClInclude>
+    <ClInclude Include="..\runtime\NullGetterFunction.h">
+      <Filter>runtime</Filter>
+    </ClInclude>
     <ClInclude Include="..\runtime\NumberConstructor.h">
       <Filter>runtime</Filter>
     </ClInclude>

Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (177029 => 177030)


--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2014-12-09 19:52:40 UTC (rev 177030)
@@ -917,6 +917,7 @@
 		6511230714046B0A002B101D /* testRegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651122E5140469BA002B101D /* testRegExp.cpp */; };
 		6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 6514F21718B3E1670098FF8B /* Bytecodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		65303D641447B9E100D3F904 /* ParserTokens.h in Headers */ = {isa = PBXBuildFile; fileRef = 65303D631447B9E100D3F904 /* ParserTokens.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		6546F5211A32B313006F07D5 /* NullGetterFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */; };
 		6553A33117A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */; };
 		6553A33217A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */; };
 		655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
@@ -2562,6 +2563,8 @@
 		65303D631447B9E100D3F904 /* ParserTokens.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserTokens.h; sourceTree = "<group>"; };
 		65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyNameArray.cpp; sourceTree = "<group>"; };
 		65400C100A69BAF200509887 /* PropertyNameArray.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PropertyNameArray.h; sourceTree = "<group>"; };
+		6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = NullGetterFunction.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		6546F5201A32A59C006F07D5 /* NullGetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullGetterFunction.h; sourceTree = "<group>"; };
 		6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommonSlowPathsExceptions.cpp; sourceTree = "<group>"; };
 		6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPathsExceptions.h; sourceTree = "<group>"; };
 		655EB29A10CE2581001A990E /* NodesCodegen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesCodegen.cpp; sourceTree = "<group>"; };
@@ -3154,7 +3157,7 @@
 		BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPrototype.h; sourceTree = "<group>"; };
 		BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.lut.h; sourceTree = "<group>"; };
 		BC3046060E1F497F003232CF /* Error.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Error.h; sourceTree = "<group>"; };
-		BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetterSetter.h; sourceTree = "<group>"; };
+		BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = GetterSetter.h; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
 		BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = "<group>"; };
 		BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = "<group>"; };
 		BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectFunctions.cpp; sourceTree = "<group>"; };
@@ -4439,6 +4442,8 @@
 				BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */,
 				BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */,
 				BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */,
+				6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */,
+				6546F5201A32A59C006F07D5 /* NullGetterFunction.h */,
 				BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */,
 				BC2680C30E16D4E900A06E92 /* NumberConstructor.h */,
 				F692A8700255597D01FF60F7 /* NumberObject.cpp */,
@@ -7173,6 +7178,7 @@
 				14469DE1107EC7E700650446 /* NativeErrorPrototype.cpp in Sources */,
 				148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */,
 				655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */,
+				6546F5211A32B313006F07D5 /* NullGetterFunction.cpp in Sources */,
 				14469DE2107EC7E700650446 /* NumberConstructor.cpp in Sources */,
 				14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */,
 				14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */,

Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (177029 => 177030)


--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h	2014-12-09 19:52:40 UTC (rev 177030)
@@ -1384,8 +1384,9 @@
     case GetGetter: {
         JSValue base = forNode(node->child1()).m_value;
         if (base) {
-            if (JSObject* getter = jsCast<GetterSetter*>(base)->getterConcurrently()) {
-                setConstant(node, *m_graph.freeze(getter));
+            GetterSetter* getterSetter = jsCast<GetterSetter*>(base);
+            if (!getterSetter->isGetterNull()) {
+                setConstant(node, *m_graph.freeze(getterSetter->getterConcurrently()));
                 break;
             }
         }
@@ -1397,8 +1398,9 @@
     case GetSetter: {
         JSValue base = forNode(node->child1()).m_value;
         if (base) {
-            if (JSObject* setter = jsCast<GetterSetter*>(base)->setterConcurrently()) {
-                setConstant(node, *m_graph.freeze(setter));
+            GetterSetter* getterSetter = jsCast<GetterSetter*>(base);
+            if (!getterSetter->isSetterNull()) {
+                setConstant(node, *m_graph.freeze(getterSetter->setterConcurrently()));
                 break;
             }
         }

Modified: trunk/Source/_javascript_Core/inspector/JSInjectedScriptHostPrototype.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/inspector/JSInjectedScriptHostPrototype.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/inspector/JSInjectedScriptHostPrototype.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -63,9 +63,9 @@
     JSC_NATIVE_FUNCTION("isHTMLAllCollection", jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection, DontEnum, 1);
 
     Identifier evaluateIdentifier(&vm, "evaluate");
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
     JSFunction* function = JSFunction::create(vm, globalObject, 0, evaluateIdentifier.string(), jsInjectedScriptHostPrototypeAttributeEvaluate);
-    accessor->setGetter(vm, function);
+    accessor->setGetter(vm, globalObject, function);
     putDirectNonIndexAccessor(vm, evaluateIdentifier, accessor, DontEnum | Accessor);
 }
 

Modified: trunk/Source/_javascript_Core/inspector/JSJavaScriptCallFramePrototype.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/inspector/JSJavaScriptCallFramePrototype.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/inspector/JSJavaScriptCallFramePrototype.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -66,9 +66,9 @@
 #define JSC_NATIVE_NON_INDEX_ACCESSOR(jsName, cppName, attributes) \
     { \
         Identifier identifier(&vm, jsName); \
-        GetterSetter* accessor = GetterSetter::create(vm); \
+        GetterSetter* accessor = GetterSetter::create(vm, globalObject); \
         JSFunction* function = JSFunction::create(vm, globalObject, 0, identifier.string(), cppName); \
-        accessor->setGetter(vm, function); \
+        accessor->setGetter(vm, globalObject, function); \
         putDirectNonIndexAccessor(vm, identifier, accessor, (attributes)); \
     }
 

Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/jit/JITOperations.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -1268,7 +1268,7 @@
     ASSERT(JSValue::decode(encodedObjectValue).isObject());
     JSObject* baseObj = asObject(JSValue::decode(encodedObjectValue));
 
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
 
     JSValue getter = JSValue::decode(encodedGetterValue);
     JSValue setter = JSValue::decode(encodedSetterValue);
@@ -1277,9 +1277,9 @@
     ASSERT(getter.isObject() || setter.isObject());
 
     if (!getter.isUndefined())
-        accessor->setGetter(vm, asObject(getter));
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
     if (!setter.isUndefined())
-        accessor->setSetter(vm, asObject(setter));
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
     baseObj->putDirectAccessor(exec, *identifier, accessor, Accessor);
 }
 #else
@@ -1291,16 +1291,16 @@
     ASSERT(object && object->isObject());
     JSObject* baseObj = object->getObject();
 
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
 
     ASSERT(!getter || getter->isObject());
     ASSERT(!setter || setter->isObject());
     ASSERT(getter || setter);
 
     if (getter)
-        accessor->setGetter(vm, getter->getObject());
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), getter->getObject());
     if (setter)
-        accessor->setSetter(vm, setter->getObject());
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), setter->getObject());
     baseObj->putDirectAccessor(exec, *identifier, accessor, Accessor);
 }
 #endif

Modified: trunk/Source/_javascript_Core/llint/LLIntSlowPaths.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/llint/LLIntSlowPaths.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/llint/LLIntSlowPaths.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -872,7 +872,7 @@
     ASSERT(LLINT_OP(1).jsValue().isObject());
     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
     
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
     LLINT_CHECK_EXCEPTION();
     
     JSValue getter = LLINT_OP(3).jsValue();
@@ -882,9 +882,9 @@
     ASSERT(getter.isObject() || setter.isObject());
     
     if (!getter.isUndefined())
-        accessor->setGetter(vm, asObject(getter));
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
     if (!setter.isUndefined())
-        accessor->setSetter(vm, asObject(setter));
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
     baseObj->putDirectAccessor(
         exec,
         exec->codeBlock()->identifier(pc[2].u.operand),

Modified: trunk/Source/_javascript_Core/runtime/GetterSetter.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/GetterSetter.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/GetterSetter.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -44,29 +44,29 @@
     visitor.append(&thisObject->m_setter);
 }
 
-GetterSetter* GetterSetter::withGetter(VM& vm, JSObject* newGetter)
+GetterSetter* GetterSetter::withGetter(VM& vm, JSGlobalObject* globalObject, JSObject* newGetter)
 {
-    if (!getter()) {
-        setGetter(vm, newGetter);
+    if (isGetterNull()) {
+        setGetter(vm, globalObject, newGetter);
         return this;
     }
     
-    GetterSetter* result = GetterSetter::create(vm);
-    result->setGetter(vm, newGetter);
-    result->setSetter(vm, setter());
+    GetterSetter* result = GetterSetter::create(vm, globalObject);
+    result->setGetter(vm, globalObject, newGetter);
+    result->setSetter(vm, globalObject, setter());
     return result;
 }
 
-GetterSetter* GetterSetter::withSetter(VM& vm, JSObject* newSetter)
+GetterSetter* GetterSetter::withSetter(VM& vm, JSGlobalObject* globalObject, JSObject* newSetter)
 {
-    if (!setter()) {
-        setSetter(vm, newSetter);
+    if (isSetterNull()) {
+        setSetter(vm, globalObject, newSetter);
         return this;
     }
     
-    GetterSetter* result = GetterSetter::create(vm);
-    result->setGetter(vm, getter());
-    result->setSetter(vm, newSetter);
+    GetterSetter* result = GetterSetter::create(vm, globalObject);
+    result->setGetter(vm, globalObject, getter());
+    result->setSetter(vm, globalObject, newSetter);
     return result;
 }
 
@@ -78,8 +78,6 @@
         return exec->exception();
 
     JSObject* getter = jsCast<GetterSetter*>(getterSetter)->getter();
-    if (!getter)
-        return jsUndefined();
 
     CallData callData;
     CallType callType = getter->methodTable(exec->vm())->getCallData(getter, callData);
@@ -88,13 +86,16 @@
 
 void callSetter(ExecState* exec, JSValue base, JSValue getterSetter, JSValue value, ECMAMode ecmaMode)
 {
-    JSObject* setter = jsCast<GetterSetter*>(getterSetter)->setter();
-    if (!setter) {
+    GetterSetter* getterSetterObj = jsCast<GetterSetter*>(getterSetter);
+
+    if (getterSetterObj->isSetterNull()) {
         if (ecmaMode == StrictMode)
             throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         return;
     }
 
+    JSObject* setter = getterSetterObj->setter();
+
     MarkedArgumentBuffer args;
     args.append(value);
 

Modified: trunk/Source/_javascript_Core/runtime/GetterSetter.h (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/GetterSetter.h	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/GetterSetter.h	2014-12-09 19:52:40 UTC (rev 177030)
@@ -26,6 +26,8 @@
 #include "JSCell.h"
 
 #include "CallFrame.h"
+#include "JSGlobalObject.h"
+#include "NullGetterFunction.h"
 #include "Structure.h"
 
 namespace JSC {
@@ -41,18 +43,20 @@
 class GetterSetter : public JSCell {
     friend class JIT;
 
-private:        
-    GetterSetter(VM& vm)
+private:
+    GetterSetter(VM& vm, JSGlobalObject* globalObject)
         : JSCell(vm, vm.getterSetterStructure.get())
     {
+        m_getter.set(vm, this, globalObject->nullGetterFunction());
+        m_setter.set(vm, this, globalObject->nullGetterFunction());
     }
 
 public:
     typedef JSCell Base;
 
-    static GetterSetter* create(VM& vm)
+    static GetterSetter* create(VM& vm, JSGlobalObject* globalObject)
     {
-        GetterSetter* getterSetter = new (NotNull, allocateCell<GetterSetter>(vm.heap)) GetterSetter(vm);
+        GetterSetter* getterSetter = new (NotNull, allocateCell<GetterSetter>(vm.heap)) GetterSetter(vm, globalObject);
         getterSetter->finishCreation(vm);
         return getterSetter;
     }
@@ -68,13 +72,19 @@
         return result;
     }
 
+    bool isGetterNull() const { return !!jsDynamicCast<NullGetterFunction*>(m_getter.get()); }
+    bool isSetterNull() const { return !!jsDynamicCast<NullGetterFunction*>(m_setter.get()); }
+
     // Set the getter. It's only valid to call this if you've never set the getter on this
     // object.
-    void setGetter(VM& vm, JSObject* getter)
+    void setGetter(VM& vm, JSGlobalObject* globalObject, JSObject* getter)
     {
-        RELEASE_ASSERT(!m_getter);
+        if (!getter)
+            getter = jsCast<JSObject*>(globalObject->nullGetterFunction());
+
+        RELEASE_ASSERT(isGetterNull());
         WTF::storeStoreFence();
-        m_getter.setMayBeNull(vm, this, getter);
+        m_getter.set(vm, this, getter);
     }
 
     JSObject* setter() const { return m_setter.get(); }
@@ -88,15 +98,18 @@
 
     // Set the setter. It's only valid to call this if you've never set the setter on this
     // object.
-    void setSetter(VM& vm, JSObject* setter)
+    void setSetter(VM& vm, JSGlobalObject* globalObject, JSObject* setter)
     {
-        RELEASE_ASSERT(!m_setter);
+        if (!setter)
+            setter = jsCast<JSObject*>(globalObject->nullGetterFunction());
+
+        RELEASE_ASSERT(isSetterNull());
         WTF::storeStoreFence();
-        m_setter.setMayBeNull(vm, this, setter);
+        m_setter.set(vm, this, setter);
     }
 
-    GetterSetter* withGetter(VM&, JSObject* getter);
-    GetterSetter* withSetter(VM&, JSObject* setter);
+    GetterSetter* withGetter(VM&, JSGlobalObject*, JSObject* getter);
+    GetterSetter* withSetter(VM&, JSGlobalObject*, JSObject* setter);
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     {

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -99,6 +99,7 @@
 #include "NamePrototype.h"
 #include "NativeErrorConstructor.h"
 #include "NativeErrorPrototype.h"
+#include "NullGetterFunction.h"
 #include "NumberConstructor.h"
 #include "NumberPrototype.h"
 #include "ObjCCallbackFunction.h"
@@ -232,10 +233,11 @@
     m_functionPrototype->addFunctionProperties(exec, this, &callFunction, &applyFunction);
     m_callFunction.set(vm, this, callFunction);
     m_applyFunction.set(vm, this, applyFunction);
+    m_nullGetterFunction.set(vm, this, NullGetterFunction::create(vm, NullGetterFunction::createStructure(vm, this, m_functionPrototype.get())));
     m_objectPrototype.set(vm, this, ObjectPrototype::create(vm, this, ObjectPrototype::createStructure(vm, this, jsNull())));
-    GetterSetter* protoAccessor = GetterSetter::create(vm);
-    protoAccessor->setGetter(vm, JSFunction::create(vm, this, 0, String(), globalFuncProtoGetter));
-    protoAccessor->setSetter(vm, JSFunction::create(vm, this, 0, String(), globalFuncProtoSetter));
+    GetterSetter* protoAccessor = GetterSetter::create(vm, this);
+    protoAccessor->setGetter(vm, this, JSFunction::create(vm, this, 0, String(), globalFuncProtoGetter));
+    protoAccessor->setSetter(vm, this, JSFunction::create(vm, this, 0, String(), globalFuncProtoSetter));
     m_objectPrototype->putDirectNonIndexAccessor(vm, vm.propertyNames->underscoreProto, protoAccessor, Accessor | DontEnum);
     m_functionPrototype->structure()->setPrototypeWithoutTransition(vm, m_objectPrototype.get());
     
@@ -609,9 +611,9 @@
 void JSGlobalObject::createThrowTypeError(VM& vm)
 {
     JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeError);
-    GetterSetter* getterSetter = GetterSetter::create(vm);
-    getterSetter->setGetter(vm, thrower);
-    getterSetter->setSetter(vm, thrower);
+    GetterSetter* getterSetter = GetterSetter::create(vm, this);
+    getterSetter->setGetter(vm, this, thrower);
+    getterSetter->setSetter(vm, this, thrower);
     m_throwTypeErrorGetterSetter.set(vm, this, getterSetter);
 }
 
@@ -651,6 +653,8 @@
     visitor.append(&thisObject->m_promiseConstructor);
 #endif
 
+    visitor.append(&thisObject->m_nullGetterFunction);
+
     visitor.append(&thisObject->m_evalFunction);
     visitor.append(&thisObject->m_callFunction);
     visitor.append(&thisObject->m_applyFunction);

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.h (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.h	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.h	2014-12-09 19:52:40 UTC (rev 177030)
@@ -80,6 +80,7 @@
 class RegExpConstructor;
 class RegExpPrototype;
 class SourceCode;
+class NullGetterFunction;
 struct ActivationStackNode;
 struct HashTable;
 
@@ -174,6 +175,8 @@
 #endif
     WriteBarrier<ObjectConstructor> m_objectConstructor;
 
+    WriteBarrier<NullGetterFunction> m_nullGetterFunction;
+
     WriteBarrier<JSFunction> m_evalFunction;
     WriteBarrier<JSFunction> m_callFunction;
     WriteBarrier<JSFunction> m_applyFunction;
@@ -371,6 +374,8 @@
     JSPromiseConstructor* promiseConstructor() const { return m_promiseConstructor.get(); }
 #endif
 
+    NullGetterFunction* nullGetterFunction() const { return m_nullGetterFunction.get(); }
+
     JSFunction* evalFunction() const { return m_evalFunction.get(); }
     JSFunction* callFunction() const { return m_callFunction.get(); }
     JSFunction* applyFunction() const { return m_applyFunction.get(); }

Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/JSObject.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -1689,11 +1689,11 @@
         else if (oldDescriptor.isAccessorDescriptor())
             setter = oldDescriptor.setterObject();
 
-        GetterSetter* accessor = GetterSetter::create(vm);
+        GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
         if (getter)
-            accessor->setGetter(vm, getter);
+            accessor->setGetter(vm, exec->lexicalGlobalObject(), getter);
         if (setter)
-            accessor->setSetter(vm, setter);
+            accessor->setSetter(vm, exec->lexicalGlobalObject(), setter);
 
         entryInMap->set(vm, this, accessor);
         entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor) & ~ReadOnly;
@@ -2463,11 +2463,11 @@
     VM& vm = exec->vm();
     if (descriptor.isGenericDescriptor() || descriptor.isDataDescriptor()) {
         if (descriptor.isGenericDescriptor() && oldDescriptor.isAccessorDescriptor()) {
-            GetterSetter* accessor = GetterSetter::create(vm);
+            GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
             if (oldDescriptor.getterPresent())
-                accessor->setGetter(vm, oldDescriptor.getterObject());
+                accessor->setGetter(vm, exec->lexicalGlobalObject(), oldDescriptor.getterObject());
             if (oldDescriptor.setterPresent())
-                accessor->setSetter(vm, oldDescriptor.setterObject());
+                accessor->setSetter(vm, exec->lexicalGlobalObject(), oldDescriptor.setterObject());
             target->putDirectAccessor(exec, propertyName, accessor, attributes | Accessor);
             return true;
         }
@@ -2482,16 +2482,16 @@
         return true;
     }
     attributes &= ~ReadOnly;
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
 
     if (descriptor.getterPresent())
-        accessor->setGetter(vm, descriptor.getterObject());
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), descriptor.getterObject());
     else if (oldDescriptor.getterPresent())
-        accessor->setGetter(vm, oldDescriptor.getterObject());
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), oldDescriptor.getterObject());
     if (descriptor.setterPresent())
-        accessor->setSetter(vm, descriptor.setterObject());
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), descriptor.setterObject());
     else if (oldDescriptor.setterPresent())
-        accessor->setSetter(vm, oldDescriptor.setterObject());
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), oldDescriptor.setterObject());
 
     target->putDirectAccessor(exec, propertyName, accessor, attributes | Accessor);
     return true;
@@ -2632,17 +2632,17 @@
     GetterSetter* getterSetter;
     bool getterSetterChanged = false;
     if (accessor.isCustomGetterSetter())
-        getterSetter = GetterSetter::create(exec->vm());
+        getterSetter = GetterSetter::create(exec->vm(), exec->lexicalGlobalObject());
     else {
         ASSERT(accessor.isGetterSetter());
         getterSetter = asGetterSetter(accessor);
     }
     if (descriptor.setterPresent()) {
-        getterSetter = getterSetter->withSetter(exec->vm(), descriptor.setterObject());
+        getterSetter = getterSetter->withSetter(exec->vm(), exec->lexicalGlobalObject(), descriptor.setterObject());
         getterSetterChanged = true;
     }
     if (descriptor.getterPresent()) {
-        getterSetter = getterSetter->withGetter(exec->vm(), descriptor.getterObject());
+        getterSetter = getterSetter->withGetter(exec->vm(), exec->lexicalGlobalObject(), descriptor.getterObject());
         getterSetterChanged = true;
     }
     if (current.attributesEqual(descriptor) && !getterSetterChanged)

Modified: trunk/Source/_javascript_Core/runtime/MapPrototype.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/MapPrototype.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/MapPrototype.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -70,9 +70,9 @@
     JSC_NATIVE_FUNCTION(vm.propertyNames->entries, mapProtoFuncEntries, DontEnum, 0);
     JSC_NATIVE_FUNCTION(vm.propertyNames->iteratorPrivateName, mapProtoFuncEntries, DontEnum, 0);
 
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
     JSFunction* function = JSFunction::create(vm, globalObject, 0, vm.propertyNames->size.string(), mapProtoFuncSize);
-    accessor->setGetter(vm, function);
+    accessor->setGetter(vm, globalObject, function);
     putDirectNonIndexAccessor(vm, vm.propertyNames->size, accessor, DontEnum | Accessor);
 }
 

Added: trunk/Source/_javascript_Core/runtime/NullGetterFunction.cpp (0 => 177030)


--- trunk/Source/_javascript_Core/runtime/NullGetterFunction.cpp	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/NullGetterFunction.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NullGetterFunction.h"
+
+#include "JSCJSValueInlines.h"
+
+namespace JSC {
+
+const ClassInfo NullGetterFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(NullGetterFunction) };
+
+static EncodedJSValue JSC_HOST_CALL callReturnUndefined(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL constructReturnUndefined(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+CallType NullGetterFunction::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callReturnUndefined;
+    return CallTypeHost;
+}
+
+ConstructType NullGetterFunction::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructReturnUndefined;
+    return ConstructTypeHost;
+}
+
+}

Added: trunk/Source/_javascript_Core/runtime/NullGetterFunction.h (0 => 177030)


--- trunk/Source/_javascript_Core/runtime/NullGetterFunction.h	                        (rev 0)
+++ trunk/Source/_javascript_Core/runtime/NullGetterFunction.h	2014-12-09 19:52:40 UTC (rev 177030)
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NullGetterFunction_h
+#define  NullGetterFunction_h
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class NullGetterFunction : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static NullGetterFunction* create(VM& vm, Structure* structure)
+    {
+        NullGetterFunction* function = new (NotNull, allocateCell< NullGetterFunction>(vm.heap))  NullGetterFunction(vm, structure);
+        function->finishCreation(vm, String());
+        return function;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    NullGetterFunction(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+}
+
+#endif // NullGetterFunction_h

Modified: trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -156,8 +156,8 @@
     PropertySlot slot(thisObject);
     if (thisObject->getPropertySlot(exec, exec->argument(0).toString(exec)->toIdentifier(exec), slot)
         && slot.isAccessor()) {
-        JSObject* getter = slot.getterSetter()->getter();
-        return getter ? JSValue::encode(getter) : JSValue::encode(jsUndefined());
+        GetterSetter* getterSetter = slot.getterSetter();
+        return getterSetter->isGetterNull() ? JSValue::encode(jsUndefined()) : JSValue::encode(getterSetter->getter());
     }
 
     return JSValue::encode(jsUndefined());
@@ -172,8 +172,8 @@
     PropertySlot slot(thisObject);
     if (thisObject->getPropertySlot(exec, exec->argument(0).toString(exec)->toIdentifier(exec), slot)
         && slot.isAccessor()) {
-        JSObject* setter = slot.getterSetter()->setter();
-        return setter ? JSValue::encode(setter) : JSValue::encode(jsUndefined());
+        GetterSetter* getterSetter = slot.getterSetter();
+        return getterSetter->isSetterNull() ? JSValue::encode(jsUndefined()) : JSValue::encode(getterSetter->setter());
     }
 
     return JSValue::encode(jsUndefined());

Modified: trunk/Source/_javascript_Core/runtime/PropertyDescriptor.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/PropertyDescriptor.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/PropertyDescriptor.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -106,8 +106,8 @@
         m_attributes &= ~ReadOnly; // FIXME: we should be able to ASSERT this!
 
         GetterSetter* accessor = asGetterSetter(value);
-        m_getter = accessor->getter() ? accessor->getter() : jsUndefined();
-        m_setter = accessor->setter() ? accessor->setter() : jsUndefined();
+        m_getter = !accessor->isGetterNull() ? accessor->getter() : jsUndefined();
+        m_setter = !accessor->isSetterNull() ? accessor->setter() : jsUndefined();
         m_seenAttributes = EnumerablePresent | ConfigurablePresent;
     } else {
         m_value = value;
@@ -131,8 +131,8 @@
     attributes &= ~ReadOnly; // FIXME: we should be able to ASSERT this!
 
     m_attributes = attributes;
-    m_getter = accessor->getter() ? accessor->getter() : jsUndefined();
-    m_setter = accessor->setter() ? accessor->setter() : jsUndefined();
+    m_getter = !accessor->isGetterNull() ? accessor->getter() : jsUndefined();
+    m_setter = !accessor->isSetterNull() ? accessor->setter() : jsUndefined();
     m_seenAttributes = EnumerablePresent | ConfigurablePresent;
 }
 

Modified: trunk/Source/_javascript_Core/runtime/SetPrototype.cpp (177029 => 177030)


--- trunk/Source/_javascript_Core/runtime/SetPrototype.cpp	2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/_javascript_Core/runtime/SetPrototype.cpp	2014-12-09 19:52:40 UTC (rev 177030)
@@ -69,9 +69,9 @@
     JSC_NATIVE_FUNCTION(vm.propertyNames->entries, setProtoFuncEntries, DontEnum, 0);
     JSC_NATIVE_FUNCTION(vm.propertyNames->iteratorPrivateName, setProtoFuncKeys, DontEnum, 0);
 
-    GetterSetter* accessor = GetterSetter::create(vm);
+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
     JSFunction* function = JSFunction::create(vm, globalObject, 0, vm.propertyNames->size.string(), setProtoFuncSize);
-    accessor->setGetter(vm, function);
+    accessor->setGetter(vm, globalObject, function);
     putDirectNonIndexAccessor(vm, vm.propertyNames->size, accessor, DontEnum | Accessor);
 }
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to