Title: [167563] trunk/Source/_javascript_Core
- Revision
- 167563
- Author
- [email protected]
- Date
- 2014-04-19 21:42:42 -0700 (Sat, 19 Apr 2014)
Log Message
It should be OK to store new fields into objects that have no prototypes
https://bugs.webkit.org/show_bug.cgi?id=131905
Reviewed by Mark Hahnenberg.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitPrototypeChecks):
* tests/stress/put-by-id-transition-null-prototype.js: Added.
(foo):
Modified Paths
Added Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (167562 => 167563)
--- trunk/Source/_javascript_Core/ChangeLog 2014-04-20 03:38:09 UTC (rev 167562)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-04-20 04:42:42 UTC (rev 167563)
@@ -1,3 +1,15 @@
+2014-04-19 Filip Pizlo <[email protected]>
+
+ It should be OK to store new fields into objects that have no prototypes
+ https://bugs.webkit.org/show_bug.cgi?id=131905
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+ * tests/stress/put-by-id-transition-null-prototype.js: Added.
+ (foo):
+
2014-04-19 Benjamin Poulain <[email protected]>
Make the CSS JIT compile for ARM64
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (167562 => 167563)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2014-04-20 03:38:09 UTC (rev 167562)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2014-04-20 04:42:42 UTC (rev 167563)
@@ -1885,7 +1885,6 @@
currentStructure = chain->at(i);
base = cellConstantWithStructureCheck(currentObject, currentStructure);
}
- RELEASE_ASSERT(base);
return base;
}
Added: trunk/Source/_javascript_Core/tests/stress/put-by-id-transition-null-prototype.js (0 => 167563)
--- trunk/Source/_javascript_Core/tests/stress/put-by-id-transition-null-prototype.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/put-by-id-transition-null-prototype.js 2014-04-20 04:42:42 UTC (rev 167563)
@@ -0,0 +1,13 @@
+function foo(o) {
+ o.f = 42;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100000; ++i) {
+ var o = Object.create(null);
+ foo(o);
+ if (o.f != 42)
+ throw "Error: bad result: " + o.f;
+}
+
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
