Bug 30372 - Make typeinfo flags default to false
: Make typeinfo flags default to false
Status: RESOLVED FIXED
: WebKit
JavaScriptCore
: 528+ (Nightly build)
: PC Mac OS X 10.5
: P2 Normal
Assigned To:
:
:
:
:
  Show dependency treegraph
 
Reported: 2009-10-14 20:06 PST by
Modified: 2009-10-20 02:43 PST (History)


Attachments
Reverse the meaning of HasDefaultGetPropertySlot (29.19 KB, patch)
2009-10-14 20:11 PST, Oliver Hunt
no flags Review Patch | Details | Formatted Diff | Diff
HasDefaultMark to OverridesMarkChildren (35.58 KB, patch)
2009-10-15 11:28 PST, Oliver Hunt
no flags Review Patch | Details | Formatted Diff | Diff
HasDefaultGetPropertyNames -> OverridesGetPropertyNames (31.81 KB, patch)
2009-10-16 11:58 PST, Oliver Hunt
barraclough: review+
Review Patch | Details | Formatted Diff | Diff
Move OverridesMarkChildren flag from DatePrototype to its parent class (2.33 KB, patch)
2009-10-20 02:26 PST, Gabor Loki
oliver: review+
Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2009-10-14 20:06:16 PST
It's difficult to ensure correct semantics for typeinfo flags in the dom bindings, as we can't easily propagate the typeinfo flags.  To make it easier to propagate we want to make flags be specifically for the exceptional cases.
------- Comment #1 From 2009-10-14 20:11:40 PST -------
Created an attachment (id=41202) [details]
Reverse the meaning of HasDefaultGetPropertySlot
------- Comment #2 From 2009-10-14 20:16:26 PST -------
(From update of attachment 41202 [details])
r=me w/ChangeLog
------- Comment #3 From 2009-10-15 11:28:37 PST -------
Created an attachment (id=41237) [details]
HasDefaultMark to OverridesMarkChildren
------- Comment #4 From 2009-10-15 12:34:44 PST -------
(From update of attachment 41237 [details])
> -        return Structure::create(prototype, TypeInfo(ObjectType));
> +        return Structure::create(prototype, TypeInfo(ObjectType,  JSC::OverridesGetOwnPropertySlot | JSC::HasNonDefaultMark));

Extra space here, and "JSC::" is not needed.

I guess the assertion we have will catch if we got this wrong anywhere at runtime. Please be sure to run all the regression tests before landing since that will be caught at runtime, not compile time.

r=me
------- Comment #5 From 2009-10-15 12:57:18 PST -------
Landed default mark patch in r49649
------- Comment #6 From 2009-10-16 11:58:47 PST -------
Created an attachment (id=41304) [details]
HasDefaultGetPropertyNames -> OverridesGetPropertyNames
------- Comment #7 From 2009-10-16 14:54:47 PST -------
Landed r 49694
------- Comment #8 From 2009-10-20 02:26:26 PST -------
Created an attachment (id=41491) [details]
Move OverridesMarkChildren flag from DatePrototype to its parent class

The following simple JS fails on ARM JIT (JSValue32):
---
[new Date()]
gc()
---

It looks like JSWrapperObject::markChildren was called for DateInstance in JSArray, but the m_internalValue was already on anonymous slots.

The attached patch fixes this issue by moving OverridesMarkChildren flag from DatePrototype to DateInstance.

BTW, is there any delivered class which should still use JSWrapperObject::markChildren?
------- Comment #9 From 2009-10-20 02:43:53 PST -------
(In reply to comment #8)
> Created an attachment (id=41491) [details] [details]

Sending        JavaScriptCore/ChangeLog
Sending        JavaScriptCore/runtime/DateInstance.h
Sending        JavaScriptCore/runtime/DatePrototype.h
Transmitting file data ...
Committed revision 49845.