<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197412] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197412">197412</a></dd>
<dt>Author</dt> <dd>sbarati@apple.com</dd>
<dt>Date</dt> <dd>2016-03-01 13:45:16 -0800 (Tue, 01 Mar 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>[[IsExtensible]] should be a virtual method in the method table
https://bugs.webkit.org/show_bug.cgi?id=154799

Reviewed by Mark Lam.

This patch makes us more consistent with how the ES6 specification models the
[[IsExtensible]] trap. Moving this method into ClassInfo::methodTable 
is a prerequisite for implementing Proxy.[[IsExtensible]].

* runtime/ClassInfo.h:
* runtime/JSCell.cpp:
(JSC::JSCell::preventExtensions):
(JSC::JSCell::isExtensible):
* runtime/JSCell.h:
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncProtoSetter):
* runtime/JSObject.cpp:
(JSC::JSObject::preventExtensions):
(JSC::JSObject::isExtensible):
(JSC::JSObject::reifyAllStaticProperties):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::defineOwnNonIndexProperty):
(JSC::JSObject::defineOwnProperty):
* runtime/JSObject.h:
(JSC::JSObject::isSealed):
(JSC::JSObject::isFrozen):
(JSC::JSObject::isExtensibleImpl):
(JSC::JSObject::isStructureExtensible):
(JSC::JSObject::isExtensibleInline):
(JSC::JSObject::indexingShouldBeSparse):
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::isExtensible): Deleted.
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSetPrototypeOf):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):
(JSC::objectConstructorIsExtensible):
(JSC::objectConstructorIs):
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
* runtime/ReflectObject.cpp:
(JSC::reflectObjectIsExtensible):
(JSC::reflectObjectSetPrototypeOf):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::putEntry):
(JSC::SparseArrayValueMap::putDirect):
* runtime/StringObject.cpp:
(JSC::StringObject::defineOwnProperty):
* runtime/Structure.cpp:
(JSC::Structure::isSealed):
(JSC::Structure::isFrozen):
* runtime/Structure.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeClassInfoh">trunk/Source/JavaScriptCore/runtime/ClassInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellh">trunk/Source/JavaScriptCore/runtime/JSCell.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjectcpp">trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeReflectObjectcpp">trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp">trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringObjectcpp">trunk/Source/JavaScriptCore/runtime/StringObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructurecpp">trunk/Source/JavaScriptCore/runtime/Structure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -1,3 +1,61 @@
</span><ins>+2016-03-01  Saam barati  &lt;sbarati@apple.com&gt;
+
+        [[IsExtensible]] should be a virtual method in the method table
+        https://bugs.webkit.org/show_bug.cgi?id=154799
+
+        Reviewed by Mark Lam.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[IsExtensible]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[IsExtensible]].
+
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::preventExtensions):
+        (JSC::JSCell::isExtensible):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::isExtensible):
+        (JSC::JSObject::reifyAllStaticProperties):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::isExtensibleImpl):
+        (JSC::JSObject::isStructureExtensible):
+        (JSC::JSObject::isExtensibleInline):
+        (JSC::JSObject::indexingShouldBeSparse):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::isExtensible): Deleted.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        (JSC::objectConstructorIs):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/Structure.cpp:
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        * runtime/Structure.h:
+
</ins><span class="cx"> 2016-03-01  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, fix CLOOP build.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeClassInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ClassInfo.h (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ClassInfo.h        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/ClassInfo.h        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -106,6 +106,9 @@
</span><span class="cx">     typedef bool (*PreventExtensionsFunctionPtr)(JSObject*, ExecState*);
</span><span class="cx">     PreventExtensionsFunctionPtr preventExtensions;
</span><span class="cx"> 
</span><ins>+    typedef bool (*IsExtensibleFunctionPtr)(JSObject*, ExecState*);
+    IsExtensibleFunctionPtr isExtensible;
+
</ins><span class="cx">     typedef void (*DumpToStreamFunctionPtr)(const JSCell*, PrintStream&amp;);
</span><span class="cx">     DumpToStreamFunctionPtr dumpToStream;
</span><span class="cx"> 
</span><span class="lines">@@ -158,6 +161,7 @@
</span><span class="cx">         &amp;ClassName::slowDownAndWasteMemory, \
</span><span class="cx">         &amp;ClassName::getTypedArrayImpl, \
</span><span class="cx">         &amp;ClassName::preventExtensions, \
</span><ins>+        &amp;ClassName::isExtensible, \
</ins><span class="cx">         &amp;ClassName::dumpToStream, \
</span><span class="cx">         &amp;ClassName::estimatedSize \
</span><span class="cx">     }, \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -275,4 +275,9 @@
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+bool JSCell::isExtensible(JSObject*, ExecState*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.h (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.h        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.h        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -207,6 +207,7 @@
</span><span class="cx">     static NO_RETURN_DUE_TO_CRASH void getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
</span><span class="cx">     static NO_RETURN_DUE_TO_CRASH void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
</span><span class="cx">     static NO_RETURN_DUE_TO_CRASH bool preventExtensions(JSObject*, ExecState*);
</span><ins>+    static NO_RETURN_DUE_TO_CRASH bool isExtensible(JSObject*, ExecState*);
</ins><span class="cx"> 
</span><span class="cx">     static String className(const JSObject*);
</span><span class="cx">     JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -885,7 +885,10 @@
</span><span class="cx">     if (thisObject-&gt;prototype() == value)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-    if (!thisObject-&gt;isExtensible())
</del><ins>+    bool isExtensible = thisObject-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(jsUndefined());
+    if (!isExtensible)
</ins><span class="cx">         return throwVMError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
</span><span class="cx"> 
</span><span class="cx">     if (!thisObject-&gt;setPrototypeWithCycleCheck(exec, value))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -1677,8 +1677,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::preventExtensions(JSObject* object, ExecState* exec)
</span><span class="cx"> {
</span><del>-    if (!object-&gt;isExtensible())
</del><ins>+    if (!object-&gt;isStructureExtensible()) {
+        // We've already set the internal [[PreventExtensions]] field to false.
+        // We don't call the methodTable isExtensible here because it's not defined
+        // that way in the specification. We are just doing an optimization here.
</ins><span class="cx">         return true;
</span><ins>+    }
</ins><span class="cx"> 
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     object-&gt;enterDictionaryIndexingMode(vm);
</span><span class="lines">@@ -1686,6 +1690,11 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+bool JSObject::isExtensible(JSObject* obj, ExecState*)
+{
+    return obj-&gt;isExtensibleImpl();
+}
+
</ins><span class="cx"> void JSObject::reifyAllStaticProperties(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!staticFunctionsReified());
</span><span class="lines">@@ -1821,7 +1830,7 @@
</span><span class="cx">     // 3. If current is undefined and extensible is false, then Reject.
</span><span class="cx">     // 4. If current is undefined and extensible is true, then
</span><span class="cx">     if (result.isNewEntry) {
</span><del>-        if (!isExtensible()) {
</del><ins>+        if (!isStructureExtensible()) {
</ins><span class="cx">             map-&gt;remove(result.iterator);
</span><span class="cx">             return reject(exec, throwException, &quot;Attempting to define property on object that is not extensible.&quot;);
</span><span class="cx">         }
</span><span class="lines">@@ -2037,7 +2046,7 @@
</span><span class="cx">     // First, handle cases where we don't currently have a sparse map.
</span><span class="cx">     if (LIKELY(!map)) {
</span><span class="cx">         // If the array is not extensible, we should have entered dictionary mode, and created the sparse map.
</span><del>-        ASSERT(isExtensible());
</del><ins>+        ASSERT(isStructureExtensible());
</ins><span class="cx">     
</span><span class="cx">         // Update m_length if necessary.
</span><span class="cx">         if (i &gt;= storage-&gt;length())
</span><span class="lines">@@ -2063,7 +2072,7 @@
</span><span class="cx">     unsigned length = storage-&gt;length();
</span><span class="cx">     if (i &gt;= length) {
</span><span class="cx">         // Prohibit growing the array if length is not writable.
</span><del>-        if (map-&gt;lengthIsReadOnly() || !isExtensible()) {
</del><ins>+        if (map-&gt;lengthIsReadOnly() || !isStructureExtensible()) {
</ins><span class="cx">             if (shouldThrow)
</span><span class="cx">                 throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="cx">             return;
</span><span class="lines">@@ -2183,7 +2192,7 @@
</span><span class="cx">     // First, handle cases where we don't currently have a sparse map.
</span><span class="cx">     if (LIKELY(!map)) {
</span><span class="cx">         // If the array is not extensible, we should have entered dictionary mode, and created the spare map.
</span><del>-        ASSERT(isExtensible());
</del><ins>+        ASSERT(isStructureExtensible());
</ins><span class="cx">     
</span><span class="cx">         // Update m_length if necessary.
</span><span class="cx">         if (i &gt;= storage-&gt;length())
</span><span class="lines">@@ -2213,7 +2222,7 @@
</span><span class="cx">             // Prohibit growing the array if length is not writable.
</span><span class="cx">             if (map-&gt;lengthIsReadOnly())
</span><span class="cx">                 return reject(exec, mode == PutDirectIndexShouldThrow, StrictModeReadonlyPropertyWriteError);
</span><del>-            if (!isExtensible())
</del><ins>+            if (!isStructureExtensible())
</ins><span class="cx">                 return reject(exec, mode == PutDirectIndexShouldThrow, &quot;Attempting to define property on object that is not extensible.&quot;);
</span><span class="cx">         }
</span><span class="cx">         length = i + 1;
</span><span class="lines">@@ -2848,7 +2857,10 @@
</span><span class="cx">     DefineOwnPropertyScope scope(exec);
</span><span class="cx">     PropertyDescriptor current;
</span><span class="cx">     bool isCurrentDefined = getOwnPropertyDescriptor(exec, propertyName, current);
</span><del>-    return validateAndApplyPropertyDescriptor(exec, this, propertyName, isExtensible(), descriptor, isCurrentDefined, current, throwException);
</del><ins>+    bool isExtensible = isExtensibleInline(exec);
+    if (UNLIKELY(exec-&gt;hadException()))
+        return false;
+    return validateAndApplyPropertyDescriptor(exec, this, propertyName, isExtensible, descriptor, isCurrentDefined, current, throwException);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor&amp; descriptor, bool throwException)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -615,12 +615,33 @@
</span><span class="cx">     JS_EXPORT_PRIVATE void seal(VM&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE void freeze(VM&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE static bool preventExtensions(JSObject*, ExecState*);
</span><ins>+    JS_EXPORT_PRIVATE static bool isExtensible(JSObject*, ExecState*);
</ins><span class="cx">     bool isSealed(VM&amp; vm) { return structure(vm)-&gt;isSealed(vm); }
</span><span class="cx">     bool isFrozen(VM&amp; vm) { return structure(vm)-&gt;isFrozen(vm); }
</span><del>-    bool isExtensible() { return structure()-&gt;isExtensible(); }
</del><ins>+private:
+    ALWAYS_INLINE bool isExtensibleImpl() { return isStructureExtensible(); }
+public:
+    // You should only call isStructureExtensible() when:
+    // - Performing this check in a way that isn't described in the specification 
+    //   as calling the virtual [[IsExtensible]] trap.
+    // - When you're guaranteed that object-&gt;methodTable()-&gt;isExtensible isn't
+    //   overridden.
+    ALWAYS_INLINE bool isStructureExtensible() { return structure()-&gt;isStructureExtensible(); }
+    // You should call this when performing [[IsExtensible]] trap in a place
+    // that is described in the specification. This performs the fully virtual
+    // [[IsExtensible]] trap.
+    ALWAYS_INLINE bool isExtensibleInline(ExecState* exec)
+    { 
+        VM&amp; vm = exec-&gt;vm();
+        auto isExtensibleMethod = methodTable(vm)-&gt;isExtensible;
+        if (LIKELY(isExtensibleMethod == JSObject::isExtensible))
+            return isExtensibleImpl();
+
+        return isExtensibleMethod(this, exec);
+    }
</ins><span class="cx">     bool indexingShouldBeSparse()
</span><span class="cx">     {
</span><del>-        return !isExtensible()
</del><ins>+        return !isStructureExtensible()
</ins><span class="cx">             || structure()-&gt;typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1272,7 +1293,7 @@
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if ((mode == PutModePut) &amp;&amp; !isExtensible())
</del><ins>+        if ((mode == PutModePut) &amp;&amp; !isStructureExtensible())
</ins><span class="cx">             return false;
</span><span class="cx"> 
</span><span class="cx">         DeferGC deferGC(vm.heap);
</span><span class="lines">@@ -1337,7 +1358,7 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if ((mode == PutModePut) &amp;&amp; !isExtensible())
</del><ins>+    if ((mode == PutModePut) &amp;&amp; !isStructureExtensible())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     // We want the structure transition watchpoint to fire after this object has switched
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -212,7 +212,10 @@
</span><span class="cx">     if (object-&gt;prototype() == protoValue)
</span><span class="cx">         return JSValue::encode(objectValue);
</span><span class="cx"> 
</span><del>-    if (!object-&gt;isExtensible())
</del><ins>+    bool isExtensible = object-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+    if (!isExtensible)
</ins><span class="cx">         return throwVMError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
</span><span class="cx"> 
</span><span class="cx">     if (!object-&gt;setPrototypeWithCycleCheck(exec, protoValue)) {
</span><span class="lines">@@ -616,7 +619,10 @@
</span><span class="cx"> 
</span><span class="cx">     // 3. If the [[Extensible]] internal property of O is false, then return true.
</span><span class="cx">     // 4. Otherwise, return false.
</span><del>-    return JSValue::encode(jsBoolean(!object-&gt;isExtensible()));
</del><ins>+    bool isExtensible = object-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsBoolean(!isExtensible));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
</span><span class="lines">@@ -650,7 +656,10 @@
</span><span class="cx"> 
</span><span class="cx">     // 3. If the [[Extensible]] internal property of O is false, then return true.
</span><span class="cx">     // 4. Otherwise, return false.
</span><del>-    return JSValue::encode(jsBoolean(!object-&gt;isExtensible()));
</del><ins>+    bool isExtensible = object-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsBoolean(!isExtensible));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState* exec)
</span><span class="lines">@@ -658,7 +667,11 @@
</span><span class="cx">     JSValue obj = exec-&gt;argument(0);
</span><span class="cx">     if (!obj.isObject())
</span><span class="cx">         return JSValue::encode(jsBoolean(false));
</span><del>-    return JSValue::encode(jsBoolean(asObject(obj)-&gt;isExtensible()));
</del><ins>+    JSObject* object = asObject(obj);
+    bool isExtensible = object-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsBoolean(isExtensible));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorIs(ExecState* exec)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProxyObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -196,7 +196,10 @@
</span><span class="cx">         }
</span><span class="cx">         // FIXME: this doesn't work if 'target' is another Proxy. We don't have isExtensible implemented in a way that fits w/ Proxys.
</span><span class="cx">         // https://bugs.webkit.org/show_bug.cgi?id=154375
</span><del>-        if (!target-&gt;isExtensible()) {
</del><ins>+        bool isExtensible = target-&gt;isExtensibleInline(exec);
+        if (exec-&gt;hadException())
+            return false;
+        if (!isExtensible) {
</ins><span class="cx">             // FIXME: Come up with a test for this error. I'm not sure how to because
</span><span class="cx">             // Object.seal(o) will make all fields [[Configurable]] false.
</span><span class="cx">             // https://bugs.webkit.org/show_bug.cgi?id=154376
</span><span class="lines">@@ -207,12 +210,15 @@
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    bool isExtensible = target-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return false;
</ins><span class="cx">     PropertyDescriptor trapResultAsDescriptor;
</span><span class="cx">     toPropertyDescriptor(exec, trapResult, trapResultAsDescriptor);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return false;
</span><span class="cx">     bool throwException = false;
</span><del>-    bool valid = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, target-&gt;isExtensible(),
</del><ins>+    bool valid = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, isExtensible,
</ins><span class="cx">         trapResultAsDescriptor, isTargetPropertyDescriptorDefined, targetPropertyDescriptor, throwException);
</span><span class="cx">     if (!valid) {
</span><span class="cx">         throwVMTypeError(exec, ASCIILiteral(&quot;Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test.&quot;));
</span><span class="lines">@@ -288,7 +294,10 @@
</span><span class="cx">                 throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'has' must return 'true' for non-configurable properties.&quot;));
</span><span class="cx">                 return false;
</span><span class="cx">             }
</span><del>-            if (!target-&gt;isExtensible()) {
</del><ins>+            bool isExtensible = target-&gt;isExtensibleInline(exec);
+            if (exec-&gt;hadException())
+                return false;
+            if (!isExtensible) {
</ins><span class="cx">                 throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property.&quot;));
</span><span class="cx">                 return false;
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeReflectObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -168,7 +168,11 @@
</span><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><span class="cx">         return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.isExtensible requires the first argument be an object&quot;)));
</span><del>-    return JSValue::encode(jsBoolean(asObject(target)-&gt;isExtensible()));
</del><ins>+
+    bool isExtensible = asObject(target)-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsBoolean(isExtensible));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // http://www.ecma-international.org/ecma-262/6.0/#sec-reflect.ownkeys
</span><span class="lines">@@ -211,7 +215,10 @@
</span><span class="cx">     if (object-&gt;prototype() == proto)
</span><span class="cx">         return JSValue::encode(jsBoolean(true));
</span><span class="cx"> 
</span><del>-    if (!object-&gt;isExtensible())
</del><ins>+    bool isExtensible = object-&gt;isExtensibleInline(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+    if (!isExtensible)
</ins><span class="cx">         return JSValue::encode(jsBoolean(false));
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsBoolean(object-&gt;setPrototypeWithCycleCheck(exec, proto)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx">     // To save a separate find &amp; add, we first always add to the sparse map.
</span><span class="cx">     // In the uncommon case that this is a new property, and the array is not
</span><span class="cx">     // extensible, this is not the right thing to have done - so remove again.
</span><del>-    if (result.isNewEntry &amp;&amp; !array-&gt;isExtensible()) {
</del><ins>+    if (result.isNewEntry &amp;&amp; !array-&gt;isStructureExtensible()) {
</ins><span class="cx">         remove(result.iterator);
</span><span class="cx">         if (shouldThrow)
</span><span class="cx">             throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="lines">@@ -118,7 +118,7 @@
</span><span class="cx">     // To save a separate find &amp; add, we first always add to the sparse map.
</span><span class="cx">     // In the uncommon case that this is a new property, and the array is not
</span><span class="cx">     // extensible, this is not the right thing to have done - so remove again.
</span><del>-    if (mode != PutDirectIndexLikePutDirect &amp;&amp; result.isNewEntry &amp;&amp; !array-&gt;isExtensible()) {
</del><ins>+    if (mode != PutDirectIndexLikePutDirect &amp;&amp; result.isNewEntry &amp;&amp; !array-&gt;isStructureExtensible()) {
</ins><span class="cx">         remove(result.iterator);
</span><span class="cx">         return reject(exec, mode == PutDirectIndexShouldThrow, &quot;Attempting to define property on object that is not extensible.&quot;);
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringObject.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringObject.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/StringObject.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -86,7 +86,10 @@
</span><span class="cx">     StringObject* thisObject = jsCast&lt;StringObject*&gt;(object);
</span><span class="cx"> 
</span><span class="cx">     if (propertyName == exec-&gt;propertyNames().length) {
</span><del>-        if (!object-&gt;isExtensible()) {
</del><ins>+        bool isExtensible = object-&gt;isExtensibleInline(exec);
+        if (exec-&gt;hadException())
+            return false;
+        if (!isExtensible) {
</ins><span class="cx">             if (throwException)
</span><span class="cx">                 exec-&gt;vm().throwException(exec, createTypeError(exec, ASCIILiteral(&quot;Attempting to define property on object that is not extensible.&quot;)));
</span><span class="cx">             return false;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.cpp (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.cpp        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/Structure.cpp        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -691,7 +691,7 @@
</span><span class="cx"> // In future we may want to cache this property.
</span><span class="cx"> bool Structure::isSealed(VM&amp; vm)
</span><span class="cx"> {
</span><del>-    if (isExtensible())
</del><ins>+    if (isStructureExtensible())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="lines">@@ -710,7 +710,7 @@
</span><span class="cx"> // In future we may want to cache this property.
</span><span class="cx"> bool Structure::isFrozen(VM&amp; vm)
</span><span class="cx"> {
</span><del>-    if (isExtensible())
</del><ins>+    if (isStructureExtensible())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (197411 => 197412)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h        2016-03-01 21:40:38 UTC (rev 197411)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h        2016-03-01 21:45:16 UTC (rev 197412)
</span><span class="lines">@@ -183,7 +183,7 @@
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE bool isSealed(VM&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE bool isFrozen(VM&amp;);
</span><del>-    bool isExtensible() const { return !didPreventExtensions(); }
</del><ins>+    bool isStructureExtensible() const { return !didPreventExtensions(); }
</ins><span class="cx">     bool putWillGrowOutOfLineStorage();
</span><span class="cx">     size_t suggestedNewOutOfLineStorageCapacity(); 
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>