Bug 29168 - Allow anonymous storage inside JSObject
Summary: Allow anonymous storage inside JSObject
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Oliver Hunt
Depends on:
Reported: 2009-09-10 22:06 PDT by Oliver Hunt
Modified: 2009-09-15 16:18 PDT (History)
1 user (show)

See Also:

Patch v1 (17.56 KB, patch)
2009-09-10 22:26 PDT, Oliver Hunt
ggaren: review-
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2009-09-10 22:06:07 PDT
Comment 1 Oliver Hunt 2009-09-10 22:26:50 PDT
Created attachment 39411 [details]
Patch v1
Comment 2 Geoffrey Garen 2009-09-11 12:32:04 PDT
+size_t Structure::put(unsigned count)
+    m_propertyTable->anonymousSlotCount += count;
+    return m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount;

This API seems really weird to me.

First, it has a return value, which its only client doesn't use.

Second, its name implies that it "puts" a value, but it doesn't take a value as an argument.

Third, it increments anonymousSlotCount, but I don't see anonymousSlotCount initialized anywhere.

Fourth, m_anonymousSlotsInPrevious gets set directly in Structure::addAnonymousSlotsTransition, so what's special about anonymousSlotCount that it needs a helper function?

I think createPropertyMapHashTable needs to initialize anonymousSlotCount to 0. Then, I think addAnonymousSlotsTransition should just directly set anonymousSlotCount, like it directly sets m_anonymousSlotsInPrevious.

r- because I'm worried that anonymousSlotCount is uninitialized.
Comment 3 Oliver Hunt 2009-09-15 16:18:46 PDT
Fixed r48403