| Summary: | Caching of properties on objects that have named property getters is sometimes incorrect | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||||||||
| Component: | Bindings | Assignee: | Chris Dumez <cdumez> | ||||||||||
| Status: | RESOLVED FIXED | ||||||||||||
| Severity: | Normal | CC: | barraclough, cgarcia, commit-queue, ggaren, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer | ||||||||||
| Priority: | P2 | Keywords: | InRadar | ||||||||||
| Version: | WebKit Nightly Build | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=153599 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Chris Dumez
2015-11-19 11:54:36 PST
Created attachment 265878 [details]
WIP (Not working yet)
Created attachment 265879 [details]
WIP (Not working yet)
Created attachment 265898 [details]
Patch
Comment on attachment 265898 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=265898&action=review > Source/JavaScriptCore/runtime/JSTypeInfo.h:53 > +static const unsigned GetOwnPropertySlotIsImpureForPropertyAbsence = 1 << 13; One suggestion: GetOwnPropertySlotIsImpure implies GetOwnPropertySlotIsImpureForPropertyAbsence, but does not cause it to be set. A programmer could in error check GetOwnPropertySlotIsImpureForPropertyAbsence and think this would tell them whether property access is impure for absence – but this is not sufficient (they also need to check GetOwnPropertySlotIsImpure). As such a better approach might be to have discrete flags – where one is not a subset of another – GetOwnPropertySlotIsImpureForPropertyAbsence and GetOwnPropertySlotIsImpureForPropertyPresence. You could define GetOwnPropertySlotIsImpure to set both (GetOwnPropertySlotIsImpureForPropertyAbsence | GetOwnPropertySlotIsImpureForPropertyPresence). Classes wanting to adopt both behaviors could still use the GetOwnPropertySlotIsImpure name, but code wanting to check could safely either check …ForPropertyAbsence or …ForPropertyPresence. > LayoutTests/fast/dom/NamedNodeMap-named-getter-caching.html:16 > + lastIterationHasRightValue = true; This loop now only detects a bad value on the last iteration, no longer checks values on the first 999 interactions are as expected too. Please fix. Created attachment 265977 [details]
Patch
Comment on attachment 265977 [details] Patch Clearing flags on attachment: 265977 Committed r192693: <http://trac.webkit.org/changeset/192693> All reviewed patches have been landed. Closing bug. |