Bug 198581 – AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Tadeu Zagallo]

<rdar://problem/51099753>

[Tadeu Zagallo]

Created attachment 371438 [details]
Patch

[Saam Barati]

Comment on attachment 371438 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=371438&action=review

r=me

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:3331
> +        setTypeForNode(node, SpecObjectOther);

can you add a test for this when we don't constant fold? I think if you run with validateAIState option it should fail in the FTL if you have a test where you create a bunch of global objects.

[EWS Watchlist]

Comment on attachment 371438 [details]
Patch

Attachment 371438 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/12389465

New failing tests:
imported/blink/fast/canvas/canvas-clip-stack-persistence.html
fast/shadow-dom/svg-text-path-href-change-in-shadow-tree.html
fast/shadow-dom/svg-use-href-change-in-shadow-tree.html

[EWS Watchlist]

Created attachment 371463 [details]
Archive of layout-test-results from ews211 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews211  Port: win-future  Platform: CYGWIN_NT-10.0-17763-3.0.5-338.x86_64-x86_64-64bit

[Tadeu Zagallo]

Comment on attachment 371438 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=371438&action=review

>> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:3331
>> +        setTypeForNode(node, SpecObjectOther);
> 
> can you add a test for this when we don't constant fold? I think if you run with validateAIState option it should fail in the FTL if you have a test where you create a bunch of global objects.

I don't think that's possible for globals. Since they always have different structures and we don't emit GetGetterByOffset unless that get_by_id is monomorphic. It's possible to do that with regular objects, but that's already covered by tl-try-catch-patchpoint-with-volatile-registers.js (my original patch broke it...)

[WebKit Commit Bot]

Comment on attachment 371438 [details]
Patch

Clearing flags on attachment: 371438

Committed r246210: <https://trac.webkit.org/changeset/246210>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.