Bug 119843 – PropertySlot::setValue is ambiguous

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Gavin Barraclough]

There are three different versions of PropertySlot::setValue, one for cacheable properties, and two that are used interchangeably and inconsistently.
The problematic variants are the ones that just take a value, and one that takes a value and also the object containing the property.
Unify on always providing the object, and remove the version that just takes a value.
This always works except for JSString, where we optimize out the object (logically we should be instantiating a temporary StringObject on every property access).  Provide a version of setValue that takes a JSString as the owner of the property.  We won't store this, but it makes it clear that this interface should only be used from JSString.

[Gavin Barraclough]

Created attachment 208811 [details]
fix

[Geoffrey Garen]

Comment on attachment 208811 [details]
fix

View in context: https://bugs.webkit.org/attachment.cgi?id=208811&action=review

> Source/JavaScriptCore/runtime/PropertySlot.h:104
> +    void setValue(JSString*, JSValue value)

This would be a good place for a piece of your ChangeLog comment: Logically, the base of a string property access is a temporary StringObject, but we optimize that away.

[Gavin Barraclough]

Committed revision 154113.