ChangeLog

2013-04-02  Mark Hahnenberg  <mhahnenberg@apple.com>

        get_by_pname can become confused when iterating over objects with static properties

        https://bugs.webkit.org/show_bug.cgi?id=113831

        Reviewed by NOBODY (OOPS!).

        get_by_pname doesn't take static properties into account when using a JSPropertyNameIterator to directly 

        access an object's backing store. One way to fix this is to not cache any properties when iterating over 

        objects with static properties. This patch fixes the bug that was originally reported on swisscom.ch.

        * runtime/JSObject.cpp:

        (JSC::JSObject::getOwnNonIndexPropertyNames):

        * runtime/JSPropertyNameIterator.cpp:

        (JSC::JSPropertyNameIterator::create):

        * runtime/PropertyNameArray.h:

        (JSC::PropertyNameArray::PropertyNameArray):

        (JSC::PropertyNameArray::numCacheableSlots):

        (JSC::PropertyNameArray::setNumCacheableSlots):

        (PropertyNameArray):

2013-04-02  Geoffrey Garen  <ggaren@apple.com>

        DFG should compile a little sooner

147565

Source/JavaScriptCore/runtime/JSObject.cpp

@@void JSObject::getOwnPropertyNames(JSObj

void JSObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)

{

    getClassPropertyNames(exec, object->classInfo(), propertyNames, mode, object->staticFunctionsReified());

1535 size_t preStructurePropertyNamesCount = propertyNames.size();

15351536 object->structure()->getPropertyNamesFromStructure(exec->globalData(), propertyNames, mode);

1537 size_t numCacheableSlots = preStructurePropertyNamesCount ? 0 : propertyNames.size();

1538 propertyNames.setNumCacheableSlots(numCacheableSlots);

}

double JSObject::toNumber(ExecState* exec) const

147565

Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp

@@JSPropertyNameIterator* JSPropertyNameIt

    size_t numCacheableSlots = 0;

    if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasGetterSetterProperties()

        && !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())

57 numCacheableSlots = ~~o->str~~u~~cture()->totalStorageSize~~();

57 numCacheableSlots = propertyNames.numCacheableSlots();

    
    JSPropertyNameIterator* jsPropertyNameIterator = new (NotNull, allocateCell<JSPropertyNameIterator>(*exec->heap())) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);

    jsPropertyNameIterator->finishCreation(exec, propertyNames.data(), o);

147565

Source/JavaScriptCore/runtime/PropertyNameArray.h

@@namespace JSC {

        PropertyNameArray(JSGlobalData* globalData)

            : m_data(PropertyNameArrayData::create())

            , m_globalData(globalData)

58 , m_numCacheableSlots(0)

        {

        }

        PropertyNameArray(ExecState* exec)

            : m_data(PropertyNameArrayData::create())

            , m_globalData(&exec->globalData())

65 , m_numCacheableSlots(0)

        {

        }

@@namespace JSC {

        const_iterator begin() const { return m_data->propertyNameVector().begin(); }

        const_iterator end() const { return m_data->propertyNameVector().end(); }

        size_t numCacheableSlots() const { return m_numCacheableSlots; }

        void setNumCacheableSlots(size_t numCacheableSlots) { m_numCacheableSlots = numCacheableSlots; }

    private:

        typedef HashSet<StringImpl*, PtrHash<StringImpl*> > IdentifierSet;

        RefPtr<PropertyNameArrayData> m_data;

        IdentifierSet m_set;

        JSGlobalData* m_globalData;

97 size_t m_numCacheableSlots;

    };

} // namespace JSC

147565

LayoutTests/ChangeLog

2013-04-02  Mark Hahnenberg  <mhahnenberg@apple.com>

        get_by_pname can become confused when iterating over objects with static properties

        https://bugs.webkit.org/show_bug.cgi?id=113831

        Reviewed by NOBODY (OOPS!).

        get_by_pname doesn't take static properties into account when using a JSPropertyNameIterator to directly 

        access an object's backing store. One way to fix this is to not cache any properties when iterating over 

        objects with static properties. This patch fixes the bug that was originally reported on swisscom.ch.

        * fast/js/dom-static-property-for-in-iteration-expected.txt: Added.

        * fast/js/dom-static-property-for-in-iteration.html: Added.

2013-04-03  Felipe Zimmerle  <felipe@zimmerle.org>

        CSP blocks inline style when cloning a node

147565

LayoutTests/fast/js/dom-static-property-for-in-iteration-expected.txt

Checks that get_by_pname doesn't get confused about which properties go where when it comes to stacic properties.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS true is true

PASS successfullyParsed is true

TEST COMPLETE

nerget

0

LayoutTests/fast/js/dom-static-property-for-in-iteration.html

<!DOCTYPE html>

<html>

<head>

<title>Test</title>

<script src="resources/js-test-pre.js"></script>

</head>

<body>

    <a id="foo" href="bar">nerget</a>

    <script>

        description(

        "Checks that get_by_pname doesn't get confused about which properties go where when it comes to stacic properties."

        );

        function f(a) {

            for (var i in a) {

                var actual = a[i];

                var expected = a["" + i];

                shouldBeTrue(String(actual === expected));

            }

        }

        var g = document.getElementById("foo");

        g.foo="1";

        g.bar="2";

        g.wibble="3";

        g.hick="4";

        g.hock="5";

        g.snood="6";

        f(g);

    </script>

    <script src="resources/js-test-post.js"></script>

</body>

</html>

0