Bug 151453 - Caching of properties on objects that have named property getters is sometimes incorrect
Summary: Caching of properties on objects that have named property getters is sometime...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Bindings (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2015-11-19 11:54 PST by Chris Dumez
Modified: 2016-01-28 10:30 PST (History)
9 users (show)

See Also:


Attachments
WIP (Not working yet) (9.86 KB, patch)
2015-11-19 11:56 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
WIP (Not working yet) (11.35 KB, patch)
2015-11-19 11:58 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (18.12 KB, patch)
2015-11-19 13:57 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (18.28 KB, patch)
2015-11-20 11:59 PST, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2015-11-19 11:54:36 PST
Caching of properties on objects that have named property getters is sometimes incorrect.
Comment 1 Chris Dumez 2015-11-19 11:54:54 PST
rdar://problem/23049343
Comment 2 Chris Dumez 2015-11-19 11:56:11 PST
Created attachment 265878 [details]
WIP (Not working yet)
Comment 3 Chris Dumez 2015-11-19 11:58:14 PST
Created attachment 265879 [details]
WIP (Not working yet)
Comment 4 Chris Dumez 2015-11-19 13:57:20 PST
Created attachment 265898 [details]
Patch
Comment 5 Gavin Barraclough 2015-11-20 10:41:33 PST
Comment on attachment 265898 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=265898&action=review

> Source/JavaScriptCore/runtime/JSTypeInfo.h:53
> +static const unsigned GetOwnPropertySlotIsImpureForPropertyAbsence = 1 << 13;

One suggestion:

GetOwnPropertySlotIsImpure implies GetOwnPropertySlotIsImpureForPropertyAbsence, but does not cause it to be set. A programmer could in error check GetOwnPropertySlotIsImpureForPropertyAbsence and think this would tell them whether property access is impure for absence – but this is not sufficient (they also need to check GetOwnPropertySlotIsImpure).

As such a better approach might be to have discrete flags – where one is not a subset of another – GetOwnPropertySlotIsImpureForPropertyAbsence and GetOwnPropertySlotIsImpureForPropertyPresence. You could define GetOwnPropertySlotIsImpure to set both (GetOwnPropertySlotIsImpureForPropertyAbsence | GetOwnPropertySlotIsImpureForPropertyPresence).

Classes wanting to adopt both behaviors could still use the GetOwnPropertySlotIsImpure name, but code wanting to check could safely either check …ForPropertyAbsence or …ForPropertyPresence.

> LayoutTests/fast/dom/NamedNodeMap-named-getter-caching.html:16
> +        lastIterationHasRightValue = true;

This loop now only detects a bad value on the last iteration, no longer checks values on the first 999 interactions are as expected too. Please fix.
Comment 6 Chris Dumez 2015-11-20 11:59:04 PST
Created attachment 265977 [details]
Patch
Comment 7 WebKit Commit Bot 2015-11-20 12:45:18 PST
Comment on attachment 265977 [details]
Patch

Clearing flags on attachment: 265977

Committed r192693: <http://trac.webkit.org/changeset/192693>
Comment 8 WebKit Commit Bot 2015-11-20 12:45:22 PST
All reviewed patches have been landed.  Closing bug.