<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[168558] trunk/Source</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168558">168558</a></dd>
<dt>Author</dt> <dd>mhahnenberg@apple.com</dd>
<dt>Date</dt> <dd>2014-05-09 17:06:51 -0700 (Fri, 09 May 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>JSDOMWindow should disable property caching after a certain point
https://bugs.webkit.org/show_bug.cgi?id=132751
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
This is part of removing HasImpureGetOwnPropertySlot from JSDOMWindow. After the lookup in the static
hash table for JSDOMWindow fails we want to disable property caching even if the code that follows thinks
that it has provided a cacheable value.
* runtime/PropertySlot.h:
(JSC::PropertySlot::PropertySlot):
(JSC::PropertySlot::isCacheable):
(JSC::PropertySlot::disableCaching):
Source/WebCore:
No new tests.
This is part of removing HasImpureGetOwnPropertySlot from JSDOMWindow. After the lookup in the static
hash table for JSDOMWindow fails we want to disable property caching even if the code that follows thinks
that it has provided a cacheable value.
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::getOwnPropertySlot):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertySloth">trunk/Source/JavaScriptCore/runtime/PropertySlot.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (168557 => 168558)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-05-09 23:13:34 UTC (rev 168557)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-05-10 00:06:51 UTC (rev 168558)
</span><span class="lines">@@ -1,3 +1,19 @@
</span><ins>+2014-05-09 Mark Hahnenberg <mhahnenberg@apple.com>
+
+ JSDOMWindow should disable property caching after a certain point
+ https://bugs.webkit.org/show_bug.cgi?id=132751
+
+ Reviewed by Filip Pizlo.
+
+ This is part of removing HasImpureGetOwnPropertySlot from JSDOMWindow. After the lookup in the static
+ hash table for JSDOMWindow fails we want to disable property caching even if the code that follows thinks
+ that it has provided a cacheable value.
+
+ * runtime/PropertySlot.h:
+ (JSC::PropertySlot::PropertySlot):
+ (JSC::PropertySlot::isCacheable):
+ (JSC::PropertySlot::disableCaching):
+
</ins><span class="cx"> 2014-05-09 Andreas Kling <akling@apple.com>
</span><span class="cx">
</span><span class="cx"> 8.8% spent in Object.prototype.hasOwnProperty() on sbperftest.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertySloth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertySlot.h (168557 => 168558)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertySlot.h 2014-05-09 23:13:34 UTC (rev 168557)
+++ trunk/Source/JavaScriptCore/runtime/PropertySlot.h 2014-05-10 00:06:51 UTC (rev 168558)
</span><span class="lines">@@ -56,12 +56,18 @@
</span><span class="cx"> TypeCustomIndex
</span><span class="cx"> };
</span><span class="cx">
</span><ins>+ enum CacheabilityType {
+ CachingDisallowed,
+ CachingAllowed
+ };
+
</ins><span class="cx"> public:
</span><span class="cx"> explicit PropertySlot(const JSValue thisValue)
</span><span class="cx"> : m_propertyType(TypeUnset)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_thisValue(thisValue)
</span><span class="cx"> , m_watchpointSet(nullptr)
</span><ins>+ , m_cacheability(CachingAllowed)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -71,7 +77,7 @@
</span><span class="cx"> JSValue getValue(ExecState*, PropertyName) const;
</span><span class="cx"> JSValue getValue(ExecState*, unsigned propertyName) const;
</span><span class="cx">
</span><del>- bool isCacheable() const { return m_offset != invalidOffset; }
</del><ins>+ bool isCacheable() const { return m_cacheability == CachingAllowed && m_offset != invalidOffset; }
</ins><span class="cx"> bool isValue() const { return m_propertyType == TypeValue; }
</span><span class="cx"> bool isAccessor() const { return m_propertyType == TypeGetter; }
</span><span class="cx"> bool isCustom() const { return m_propertyType == TypeCustom; }
</span><span class="lines">@@ -79,6 +85,11 @@
</span><span class="cx"> bool isCacheableGetter() const { return isCacheable() && isAccessor(); }
</span><span class="cx"> bool isCacheableCustom() const { return isCacheable() && isCustom(); }
</span><span class="cx">
</span><ins>+ void disableCaching()
+ {
+ m_cacheability = CachingDisallowed;
+ }
+
</ins><span class="cx"> unsigned attributes() const { return m_attributes; }
</span><span class="cx">
</span><span class="cx"> PropertyOffset cachedOffset() const
</span><span class="lines">@@ -244,6 +255,7 @@
</span><span class="cx"> const JSValue m_thisValue;
</span><span class="cx"> JSObject* m_slotBase;
</span><span class="cx"> WatchpointSet* m_watchpointSet;
</span><ins>+ CacheabilityType m_cacheability;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (168557 => 168558)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-05-09 23:13:34 UTC (rev 168557)
+++ trunk/Source/WebCore/ChangeLog 2014-05-10 00:06:51 UTC (rev 168558)
</span><span class="lines">@@ -1,3 +1,19 @@
</span><ins>+2014-05-09 Mark Hahnenberg <mhahnenberg@apple.com>
+
+ JSDOMWindow should disable property caching after a certain point
+ https://bugs.webkit.org/show_bug.cgi?id=132751
+
+ Reviewed by Filip Pizlo.
+
+ No new tests.
+
+ This is part of removing HasImpureGetOwnPropertySlot from JSDOMWindow. After the lookup in the static
+ hash table for JSDOMWindow fails we want to disable property caching even if the code that follows thinks
+ that it has provided a cacheable value.
+
+ * bindings/js/JSDOMWindowCustom.cpp:
+ (WebCore::JSDOMWindow::getOwnPropertySlot):
+
</ins><span class="cx"> 2014-05-09 Benjamin Poulain <bpoulain@apple.com>
</span><span class="cx">
</span><span class="cx"> Fix the export file after r168556
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (168557 => 168558)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2014-05-09 23:13:34 UTC (rev 168557)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2014-05-10 00:06:51 UTC (rev 168558)
</span><span class="lines">@@ -196,6 +196,12 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // After this point it is no longer valid to cache any results because of
+ // the impure nature of the property accesses which follow. We can move this
+ // statement further down when we add ways to mitigate these impurities with,
+ // for example, watchpoints.
+ slot.disableCaching();
+
</ins><span class="cx"> // Check for child frames by name before built-in properties to
</span><span class="cx"> // match Mozilla. This does not match IE, but some sites end up
</span><span class="cx"> // naming frames things that conflict with window properties that
</span></span></pre>
</div>
</div>
</body>
</html>