Attachment 339150 Details for Bug 185143 – Patch

[patch] Patch

bug-185143-20180430145805.patch (text/plain), 4.74 KB, created by Keith Miller on 2018-04-30 14:58:05 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2018-04-30 14:58:05 PDT

Size: 4.74 KB

patch

obsolete

>Subversion Revision: 231166
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index f633215aeb6b07e4a593f581ce7728dd0fe8f9e6..32f56316a006093b1bb3137e35df74354138f2ec 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,18 @@
>+2018-04-30  Keith Miller  <keith_miller@apple.com>
>+
>+        Move the MayBePrototype JSCell header bit to InlineTypeFlags
>+        https://bugs.webkit.org/show_bug.cgi?id=185143
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/IndexingType.h:
>+        * runtime/JSCellInlines.h:
>+        (JSC::JSCell::setStructure):
>+        (JSC::JSCell::mayBePrototype const):
>+        (JSC::JSCell::didBecomePrototype):
>+        * runtime/JSTypeInfo.h:
>+        (JSC::TypeInfo::mayBePrototype):
>+
> 2018-04-30  Keith Miller  <keith_miller@apple.com>
> 
>         Move StructureIsImmortal to out of line flags.
>diff --git a/Source/JavaScriptCore/runtime/IndexingType.h b/Source/JavaScriptCore/runtime/IndexingType.h
>index 2426afe133b6e5928d16f6175e0d38f37bf271d9..689fae264205b1e03184190b16cc851a5ab07d80 100644
>--- a/Source/JavaScriptCore/runtime/IndexingType.h
>+++ b/Source/JavaScriptCore/runtime/IndexingType.h
>@@ -73,7 +73,6 @@ static const IndexingType MayHaveIndexedAccessors         = 0x10;
> // prototype.
> static const IndexingType IndexingTypeLockIsHeld          = 0x20;
> static const IndexingType IndexingTypeLockHasParked       = 0x40;
>-static const IndexingType IndexingTypeMayBePrototype      = 0x80;
> 
> // List of acceptable array types.
> static const IndexingType NonArray                        = 0x0;
>diff --git a/Source/JavaScriptCore/runtime/JSCellInlines.h b/Source/JavaScriptCore/runtime/JSCellInlines.h
>index ad86c483dfba7388b516a18ea8150d863e54e9fb..026d5a09b476d2a08b5e75a2637a10bafef71a8f 100644
>--- a/Source/JavaScriptCore/runtime/JSCellInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSCellInlines.h
>@@ -230,7 +230,8 @@ ALWAYS_INLINE void JSCell::setStructure(VM& vm, Structure* structure)
>         || this->structure()->transitionWatchpointSetHasBeenInvalidated()
>         || Heap::heap(this)->structureIDTable().get(structure->id()) == structure);
>     m_structureID = structure->id();
>-    m_flags = structure->typeInfo().inlineTypeFlags();
>+    // Since the Structure doesn't track TypeInfoMayBePrototype we need to make sure we copy it.
>+    m_flags = structure->typeInfo().inlineTypeFlags() | (m_flags & static_cast<TypeInfo::InlineTypeFlags>(TypeInfoMayBePrototype));
>     m_type = structure->typeInfo().type();
>     IndexingType newIndexingType = structure->indexingTypeIncludingHistory();
>     if (m_indexingTypeAndMisc != newIndexingType) {
>@@ -342,14 +343,14 @@ inline bool JSCellLock::isLocked() const
> 
> inline bool JSCell::mayBePrototype() const
> {
>-    return m_indexingTypeAndMisc & IndexingTypeMayBePrototype;
>+    return TypeInfo::mayBePrototype(inlineTypeFlags());
> }
> 
> inline void JSCell::didBecomePrototype()
> {
>     if (mayBePrototype())
>         return;
>-    WTF::atomicExchangeOr(&m_indexingTypeAndMisc, IndexingTypeMayBePrototype);
>+    m_flags |= static_cast<TypeInfo::InlineTypeFlags>(TypeInfoMayBePrototype);
> }
> 
> inline JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const
>diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
>index 2e04e1388b908b268f61b32f933262e204357556..90fe779e54135353650f4df59cd2fb3f97888b44 100644
>--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
>+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
>@@ -43,6 +43,7 @@ static const unsigned TypeOfShouldCallGetCallData = 1 << 2; // Need this flag if
> static const unsigned OverridesGetOwnPropertySlot = 1 << 3;
> static const unsigned OverridesToThis = 1 << 4; // If this is false then this returns something other than 'this'. Non-object cells that are visible to JS have this set as do some exotic objects.
> static const unsigned HasStaticPropertyTable = 1 << 5;
>+static const unsigned TypeInfoMayBePrototype = 1 << 6; // Unlike other inline flags, this will only be set on the cell itself and will not be set on the Structure.
> 
> // Out of line flags.
> 
>@@ -88,6 +89,7 @@ public:
>     bool overridesGetOwnPropertySlot() const { return overridesGetOwnPropertySlot(inlineTypeFlags()); }
>     static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags & OverridesGetOwnPropertySlot; }
>     static bool hasStaticPropertyTable(InlineTypeFlags flags) { return flags & HasStaticPropertyTable; }
>+    static bool mayBePrototype(InlineTypeFlags flags) { return flags & TypeInfoMayBePrototype; }
>     bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }
>     bool structureIsImmortal() const { return isSetOnFlags2(StructureIsImmortal); }
>     bool overridesGetPropertyNames() const { return isSetOnFlags2(OverridesGetPropertyNames); }

Actions: View | Formatted Diff | Diff

Attachments on bug 185143: 339150 | 339152