<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197531] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197531">197531</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-03-03 16:47:55 -0800 (Thu, 03 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[ES6] Add support for Symbol.toPrimitive
https://bugs.webkit.org/show_bug.cgi?id=154877
Reviewed by Saam Barati.
Source/JavaScriptCore:
This patch adds suport for Symbol.toPrimitive. Since we don't currently
generate snippits for one side of a binary operation we only need to change
the JSObject::ToPrimitive function and update some optimizations in the DFG
that need to know how conversions to primitive values should work. As of
ES6, the date prototype is also no longer special cased in the ToPrimitive
operation. Instead, Date.prototype has a Symbol.species function that
replicates the old behavior.
* bytecode/ObjectPropertyConditionSet.cpp:
(JSC::generateConditionsForPropertyMissConcurrently):
* bytecode/ObjectPropertyConditionSet.h:
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::watchConditions):
(JSC::DFG::Graph::canOptimizeStringObjectAccess):
* dfg/DFGGraph.h:
* runtime/CommonIdentifiers.h:
* runtime/DatePrototype.cpp:
(JSC::DatePrototype::finishCreation):
(JSC::dateProtoFuncToPrimitiveSymbol):
* runtime/Error.cpp:
(JSC::throwTypeError):
* runtime/Error.h:
* runtime/JSCJSValueInlines.h:
(JSC::toPreferredPrimitiveType):
* runtime/JSObject.cpp:
(JSC::callToPrimitiveFunction):
(JSC::JSObject::ordinaryToPrimitive):
(JSC::JSObject::defaultValue):
(JSC::JSObject::toPrimitive):
(JSC::JSObject::getPrimitiveNumber):
(JSC::callDefaultValueFunction): Deleted.
(JSC::throwTypeError): Deleted.
* runtime/JSObject.h:
(JSC::JSObject::toPrimitive): Deleted.
* runtime/SmallStrings.h:
* runtime/SymbolPrototype.cpp:
(JSC::SymbolPrototype::finishCreation):
* runtime/SymbolPrototype.h:
(JSC::SymbolPrototype::create):
* tests/es6.yaml:
* tests/stress/date-symbol-toprimitive.js: Added.
* tests/stress/ropes-symbol-toprimitive.js: Added.
(ropify):
(String.prototype.Symbol.toPrimitive):
* tests/stress/symbol-toprimitive.js: Added.
(foo.Symbol.toPrimitive):
(catch):
LayoutTests:
Update test for Symbol.toPrimitive.
* js/Object-getOwnPropertyNames-expected.txt:
* js/script-tests/Object-getOwnPropertyNames.js:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesscustomexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesslocationgetexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessobjectsetPrototypeOfexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-object-setPrototypeOf-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsObjectgetOwnPropertyNamesexpectedtxt">trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsscripttestsObjectgetOwnPropertyNamesjs">trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeObjectPropertyConditionSetcpp">trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeObjectPropertyConditionSeth">trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonIdentifiersh">trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDatePrototypecpp">trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeErrorcpp">trunk/Source/JavaScriptCore/runtime/Error.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeErrorh">trunk/Source/JavaScriptCore/runtime/Error.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValueInlinesh">trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSmallStringsh">trunk/Source/JavaScriptCore/runtime/SmallStrings.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolPrototypecpp">trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolPrototypeh">trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestses6yaml">trunk/Source/JavaScriptCore/tests/es6.yaml</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstressdatesymboltoprimitivejs">trunk/Source/JavaScriptCore/tests/stress/date-symbol-toprimitive.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressropessymboltoprimitivejs">trunk/Source/JavaScriptCore/tests/stress/ropes-symbol-toprimitive.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresssymboltoprimitivejs">trunk/Source/JavaScriptCore/tests/stress/symbol-toprimitive.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/LayoutTests/ChangeLog 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-03-03 Keith Miller <keith_miller@apple.com>
+
+ [ES6] Add support for Symbol.toPrimitive
+ https://bugs.webkit.org/show_bug.cgi?id=154877
+
+ Reviewed by Saam Barati.
+
+ Update test for Symbol.toPrimitive.
+
+ * js/Object-getOwnPropertyNames-expected.txt:
+ * js/script-tests/Object-getOwnPropertyNames.js:
+
</ins><span class="cx"> 2016-03-02 Ryosuke Niwa <rniwa@webkit.org>
</span><span class="cx">
</span><span class="cx"> Disallow custom elements inside template elements and share the registry for windowless documents
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossframeaccesscustomexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -17,6 +17,7 @@
</span><span class="cx"> CONSOLE MESSAGE: line 82: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 81: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> ----- tests for getting/setting interesting properties -----
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossframeaccesslocationgetexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-expected.txt (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-expected.txt 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/LayoutTests/http/tests/security/cross-frame-access-location-get-expected.txt 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 107: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 55: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossframeaccessobjectsetPrototypeOfexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-object-setPrototypeOf-expected.txt (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-object-setPrototypeOf-expected.txt 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/LayoutTests/http/tests/security/cross-frame-access-object-setPrototypeOf-expected.txt 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><ins>+CONSOLE MESSAGE: line 22: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</ins><span class="cx"> CONSOLE MESSAGE: line 25: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
</span><span class="cx"> This tests that you can't set the prototype of the window or history objects cross-origin using Object.setPrototypeOf().
</span><span class="cx">
</span></span></pre></div>
<a id="trunkLayoutTestsjsObjectgetOwnPropertyNamesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/LayoutTests/js/Object-getOwnPropertyNames-expected.txt 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx"> PASS getSortedOwnPropertyNames(Error.prototype) is ['constructor', 'message', 'name', 'toString']
</span><span class="cx"> PASS getSortedOwnPropertyNames(Math) is ['E','LN10','LN2','LOG10E','LOG2E','PI','SQRT1_2','SQRT2','abs','acos','acosh','asin','asinh','atan','atan2','atanh','cbrt','ceil','clz32','cos','cosh','exp','expm1','floor','fround','hypot','imul','log','log10','log1p','log2','max','min','pow','random','round','sign','sin','sinh','sqrt','tan','tanh','trunc']
</span><span class="cx"> PASS getSortedOwnPropertyNames(JSON) is ['parse', 'stringify']
</span><del>-PASS getSortedOwnPropertyNames(Symbol) is ['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'name', 'prototype', 'search', 'species', 'toStringTag', 'unscopables']
</del><ins>+PASS getSortedOwnPropertyNames(Symbol) is ['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'name', 'prototype', 'search', 'species', 'toPrimitive', 'toStringTag', 'unscopables']
</ins><span class="cx"> PASS getSortedOwnPropertyNames(Symbol.prototype) is ['constructor', 'toString', 'valueOf']
</span><span class="cx"> PASS getSortedOwnPropertyNames(Map) is ['length', 'name', 'prototype']
</span><span class="cx"> PASS getSortedOwnPropertyNames(Map.prototype) is ['clear', 'constructor', 'delete', 'entries', 'forEach', 'get', 'has', 'keys', 'set', 'size', 'values']
</span></span></pre></div>
<a id="trunkLayoutTestsjsscripttestsObjectgetOwnPropertyNamesjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/LayoutTests/js/script-tests/Object-getOwnPropertyNames.js 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> "Error.prototype": "['constructor', 'message', 'name', 'toString']",
</span><span class="cx"> "Math": "['E','LN10','LN2','LOG10E','LOG2E','PI','SQRT1_2','SQRT2','abs','acos','acosh','asin','asinh','atan','atan2','atanh','cbrt','ceil','clz32','cos','cosh','exp','expm1','floor','fround','hypot','imul','log','log10','log1p','log2','max','min','pow','random','round','sign','sin','sinh','sqrt','tan','tanh','trunc']",
</span><span class="cx"> "JSON": "['parse', 'stringify']",
</span><del>- "Symbol": "['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'name', 'prototype', 'search', 'species', 'toStringTag', 'unscopables']",
</del><ins>+ "Symbol": "['for', 'hasInstance', 'iterator', 'keyFor', 'length', 'name', 'prototype', 'search', 'species', 'toPrimitive', 'toStringTag', 'unscopables']",
</ins><span class="cx"> "Symbol.prototype": "['constructor', 'toString', 'valueOf']",
</span><span class="cx"> "Map": "['length', 'name', 'prototype']",
</span><span class="cx"> "Map.prototype": "['clear', 'constructor', 'delete', 'entries', 'forEach', 'get', 'has', 'keys', 'set', 'size', 'values']",
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -1,3 +1,58 @@
</span><ins>+2016-03-03 Keith Miller <keith_miller@apple.com>
+
+ [ES6] Add support for Symbol.toPrimitive
+ https://bugs.webkit.org/show_bug.cgi?id=154877
+
+ Reviewed by Saam Barati.
+
+ This patch adds suport for Symbol.toPrimitive. Since we don't currently
+ generate snippits for one side of a binary operation we only need to change
+ the JSObject::ToPrimitive function and update some optimizations in the DFG
+ that need to know how conversions to primitive values should work. As of
+ ES6, the date prototype is also no longer special cased in the ToPrimitive
+ operation. Instead, Date.prototype has a Symbol.species function that
+ replicates the old behavior.
+
+ * bytecode/ObjectPropertyConditionSet.cpp:
+ (JSC::generateConditionsForPropertyMissConcurrently):
+ * bytecode/ObjectPropertyConditionSet.h:
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::watchConditions):
+ (JSC::DFG::Graph::canOptimizeStringObjectAccess):
+ * dfg/DFGGraph.h:
+ * runtime/CommonIdentifiers.h:
+ * runtime/DatePrototype.cpp:
+ (JSC::DatePrototype::finishCreation):
+ (JSC::dateProtoFuncToPrimitiveSymbol):
+ * runtime/Error.cpp:
+ (JSC::throwTypeError):
+ * runtime/Error.h:
+ * runtime/JSCJSValueInlines.h:
+ (JSC::toPreferredPrimitiveType):
+ * runtime/JSObject.cpp:
+ (JSC::callToPrimitiveFunction):
+ (JSC::JSObject::ordinaryToPrimitive):
+ (JSC::JSObject::defaultValue):
+ (JSC::JSObject::toPrimitive):
+ (JSC::JSObject::getPrimitiveNumber):
+ (JSC::callDefaultValueFunction): Deleted.
+ (JSC::throwTypeError): Deleted.
+ * runtime/JSObject.h:
+ (JSC::JSObject::toPrimitive): Deleted.
+ * runtime/SmallStrings.h:
+ * runtime/SymbolPrototype.cpp:
+ (JSC::SymbolPrototype::finishCreation):
+ * runtime/SymbolPrototype.h:
+ (JSC::SymbolPrototype::create):
+ * tests/es6.yaml:
+ * tests/stress/date-symbol-toprimitive.js: Added.
+ * tests/stress/ropes-symbol-toprimitive.js: Added.
+ (ropify):
+ (String.prototype.Symbol.toPrimitive):
+ * tests/stress/symbol-toprimitive.js: Added.
+ (foo.Symbol.toPrimitive):
+ (catch):
+
</ins><span class="cx"> 2016-03-03 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> DFG should be able to compile StringReplace
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeObjectPropertyConditionSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -349,6 +349,20 @@
</span><span class="cx"> });
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ObjectPropertyConditionSet generateConditionsForPropertyMissConcurrently(
+ VM& vm, JSGlobalObject* globalObject, Structure* headStructure, UniquedStringImpl* uid)
+{
+ return generateConditions(
+ vm, globalObject, headStructure, nullptr,
+ [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+ ObjectPropertyCondition result = generateCondition(vm, nullptr, object, uid, PropertyCondition::Absence);
+ if (!result)
+ return false;
+ conditions.append(result);
+ return true;
+ }, Concurrent);
+}
+
</ins><span class="cx"> ObjectPropertyConditionSet generateConditionsForPropertySetterMissConcurrently(
</span><span class="cx"> VM& vm, JSGlobalObject* globalObject, Structure* headStructure, UniquedStringImpl* uid)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeObjectPropertyConditionSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -166,6 +166,9 @@
</span><span class="cx"> VM&, JSCell* owner, ExecState*, Structure* headStructure, JSObject* prototype,
</span><span class="cx"> UniquedStringImpl* uid);
</span><span class="cx">
</span><ins>+
+ObjectPropertyConditionSet generateConditionsForPropertyMissConcurrently(
+ VM&, JSGlobalObject*, Structure* headStructure, UniquedStringImpl* uid);
</ins><span class="cx"> ObjectPropertyConditionSet generateConditionsForPropertySetterMissConcurrently(
</span><span class="cx"> VM&, JSGlobalObject*, Structure* headStructure, UniquedStringImpl* uid);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -890,6 +890,18 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool Graph::watchConditions(const ObjectPropertyConditionSet& keys)
+{
+ if (!keys.isValid())
+ return false;
+
+ for (const ObjectPropertyCondition& key : keys) {
+ if (!watchCondition(key))
+ return false;
+ }
+ return true;
+}
+
</ins><span class="cx"> bool Graph::isSafeToLoad(JSObject* base, PropertyOffset offset)
</span><span class="cx"> {
</span><span class="cx"> return m_safeToLoad.contains(std::make_pair(base, offset));
</span><span class="lines">@@ -1518,6 +1530,9 @@
</span><span class="cx"> if (stringPrototypeStructure->isDictionary())
</span><span class="cx"> return false;
</span><span class="cx">
</span><ins>+ if (!watchConditions(generateConditionsForPropertyMissConcurrently(m_vm, globalObjectFor(codeOrigin), stringObjectStructure, m_vm.propertyNames->toPrimitiveSymbol.impl())))
+ return false;
+
</ins><span class="cx"> // We're being conservative here. We want DFG's ToString on StringObject to be
</span><span class="cx"> // used in both numeric contexts (that would call valueOf()) and string contexts
</span><span class="cx"> // (that would call toString()). We don't want the DFG to have to distinguish
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -650,6 +650,7 @@
</span><span class="cx"> // this also makes it cheap to query if the condition holds. Also makes sure that the GC knows
</span><span class="cx"> // what's going on.
</span><span class="cx"> bool watchCondition(const ObjectPropertyCondition&);
</span><ins>+ bool watchConditions(const ObjectPropertyConditionSet&);
</ins><span class="cx">
</span><span class="cx"> // Checks if it's known that loading from the given object at the given offset is fine. This is
</span><span class="cx"> // computed by tracking which conditions we track with watchCondition().
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonIdentifiersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -276,13 +276,13 @@
</span><span class="cx"> macro(match) \
</span><span class="cx"> macro(replace) \
</span><span class="cx"> macro(split) \
</span><del>- macro(toPrimitive)
</del><span class="cx">
</span><span class="cx"> #define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(macro) \
</span><span class="cx"> macro(hasInstance) \
</span><span class="cx"> macro(iterator) \
</span><span class="cx"> macro(search) \
</span><span class="cx"> macro(species) \
</span><ins>+ macro(toPrimitive) \
</ins><span class="cx"> macro(toStringTag) \
</span><span class="cx"> macro(unscopables)
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDatePrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -111,6 +111,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState*);
</span><ins>+EncodedJSValue JSC_HOST_CALL dateProtoFuncToPrimitiveSymbol(ExecState*);
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState*);
</span><span class="lines">@@ -499,6 +500,7 @@
</span><span class="cx"> UNUSED_PARAM(globalObject);
</span><span class="cx"> #endif // ENABLE(INTL)
</span><span class="cx">
</span><ins>+ JSC_NATIVE_FUNCTION(vm.propertyNames->toPrimitiveSymbol, dateProtoFuncToPrimitiveSymbol, DontEnum | ReadOnly, 1);
</ins><span class="cx"> // The constructor will be added later, after DateConstructor has been built.
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -597,6 +599,27 @@
</span><span class="cx"> return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleTime));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+EncodedJSValue JSC_HOST_CALL dateProtoFuncToPrimitiveSymbol(ExecState* exec)
+{
+ JSValue thisValue = exec->thisValue();
+ if (!thisValue.isObject())
+ return throwVMTypeError(exec, "Date.prototype[Symbol.toPrimitive] expected |this| to be an object.");
+ JSObject* thisObject = jsCast<JSObject*>(thisValue);
+
+ if (!exec->argumentCount())
+ return throwVMTypeError(exec, "Date.prototype[Symbol.toPrimitive] expected a first argument.");
+
+ JSValue hintValue = exec->uncheckedArgument(0);
+ PreferredPrimitiveType type = toPreferredPrimitiveType(exec, hintValue);
+ if (exec->hadException())
+ return JSValue::encode(JSValue());
+
+ if (type == NoPreference)
+ type = PreferString;
+
+ return JSValue::encode(thisObject->ordinaryToPrimitive(exec, type));
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx"> JSValue thisValue = exec->thisValue();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeErrorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Error.cpp (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Error.cpp 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/Error.cpp 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -219,6 +219,11 @@
</span><span class="cx"> return exec->vm().throwException(exec, createTypeError(exec));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+JSObject* throwTypeError(ExecState* exec, const String& message)
+{
+ return exec->vm().throwException(exec, createTypeError(exec, message));
+}
+
</ins><span class="cx"> JSObject* throwSyntaxError(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx"> return exec->vm().throwException(exec, createSyntaxError(exec, ASCIILiteral("Syntax error")));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeErrorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Error.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Error.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/Error.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -74,6 +74,7 @@
</span><span class="cx"> // Convenience wrappers, create an throw an exception with a default message.
</span><span class="cx"> JS_EXPORT_PRIVATE JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState*, const char* constructorName);
</span><span class="cx"> JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*);
</span><ins>+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String& errorMessage);
</ins><span class="cx"> JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*);
</span><span class="cx"> JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, const String& errorMessage);
</span><span class="cx"> inline JSObject* throwRangeError(ExecState* state, const String& errorMessage) { return state->vm().throwException(state, createRangeError(state, errorMessage)); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCJSValueInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -628,6 +628,28 @@
</span><span class="cx"> return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+inline PreferredPrimitiveType toPreferredPrimitiveType(ExecState* exec, JSValue value)
+{
+ if (!value.isString()) {
+ throwTypeError(exec, "Primitive hint is not a string.");
+ return NoPreference;
+ }
+
+ StringImpl* hintString = jsCast<JSString*>(value)->value(exec).impl();
+ if (exec->hadException())
+ return NoPreference;
+
+ if (WTF::equal(hintString, "default"))
+ return NoPreference;
+ if (WTF::equal(hintString, "number"))
+ return PreferNumber;
+ if (WTF::equal(hintString, "string"))
+ return PreferString;
+
+ throwTypeError(exec, "Expected primitive hint to match one of 'default', 'number', 'string'.");
+ return NoPreference;
+}
+
</ins><span class="cx"> inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
</span><span class="cx"> {
</span><span class="cx"> if (isInt32()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -1426,55 +1426,67 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static ALWAYS_INLINE JSValue callDefaultValueFunction(ExecState* exec, const JSObject* object, PropertyName propertyName)
</del><ins>+enum class TypeHintMode { TakesHint, DoesNotTakeHint };
+
+template<TypeHintMode mode = TypeHintMode::DoesNotTakeHint>
+static ALWAYS_INLINE JSValue callToPrimitiveFunction(ExecState* exec, const JSObject* object, PropertyName propertyName, PreferredPrimitiveType hint)
</ins><span class="cx"> {
</span><span class="cx"> JSValue function = object->get(exec, propertyName);
</span><ins>+ if (exec->hadException())
+ return exec->exception();
+ if (function.isUndefined() && mode == TypeHintMode::TakesHint)
+ return JSValue();
</ins><span class="cx"> CallData callData;
</span><span class="cx"> CallType callType = getCallData(function, callData);
</span><span class="cx"> if (callType == CallTypeNone)
</span><span class="cx"> return exec->exception();
</span><span class="cx">
</span><del>- // Prevent "toString" and "valueOf" from observing execution if an exception
- // is pending.
- if (exec->hadException())
- return exec->exception();
</del><ins>+ MarkedArgumentBuffer callArgs;
+ if (mode == TypeHintMode::TakesHint) {
+ JSString* hintString;
+ switch (hint) {
+ case NoPreference:
+ hintString = exec->vm().smallStrings.defaultString();
+ break;
+ case PreferNumber:
+ hintString = exec->vm().smallStrings.numberString();
+ break;
+ case PreferString:
+ hintString = exec->vm().smallStrings.stringString();
+ break;
+ }
+ callArgs.append(hintString);
+ }
</ins><span class="cx">
</span><del>- JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
</del><ins>+ JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), callArgs);
</ins><span class="cx"> ASSERT(!result.isGetterSetter());
</span><span class="cx"> if (exec->hadException())
</span><span class="cx"> return exec->exception();
</span><span class="cx"> if (result.isObject())
</span><del>- return JSValue();
</del><ins>+ return mode == TypeHintMode::DoesNotTakeHint ? JSValue() : throwTypeError(exec, "Symbol.toPrimitive returned an object");
</ins><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result) const
</del><ins>+// ECMA 7.1.1
+inline JSValue JSObject::ordinaryToPrimitive(ExecState* exec, PreferredPrimitiveType hint) const
</ins><span class="cx"> {
</span><del>- result = methodTable(exec->vm())->defaultValue(this, exec, PreferNumber);
- number = result.toNumber(exec);
- return !result.isString();
-}
-
-// ECMA 8.6.2.6
-JSValue JSObject::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
-{
</del><span class="cx"> // Make sure that whatever default value methods there are on object's prototype chain are
</span><span class="cx"> // being watched.
</span><del>- object->structure()->startWatchingInternalPropertiesIfNecessaryForEntireChain(exec->vm());
-
- // Must call toString first for Date objects.
- if ((hint == PreferString) || (hint != PreferNumber && object->prototype() == exec->lexicalGlobalObject()->datePrototype())) {
- JSValue value = callDefaultValueFunction(exec, object, exec->propertyNames().toString);
</del><ins>+ this->structure()->startWatchingInternalPropertiesIfNecessaryForEntireChain(exec->vm());
+
+ JSValue value;
+ if (hint == PreferString) {
+ value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
</ins><span class="cx"> if (value)
</span><span class="cx"> return value;
</span><del>- value = callDefaultValueFunction(exec, object, exec->propertyNames().valueOf);
</del><ins>+ value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
</ins><span class="cx"> if (value)
</span><span class="cx"> return value;
</span><span class="cx"> } else {
</span><del>- JSValue value = callDefaultValueFunction(exec, object, exec->propertyNames().valueOf);
</del><ins>+ value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
</ins><span class="cx"> if (value)
</span><span class="cx"> return value;
</span><del>- value = callDefaultValueFunction(exec, object, exec->propertyNames().toString);
</del><ins>+ value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
</ins><span class="cx"> if (value)
</span><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="lines">@@ -1484,6 +1496,27 @@
</span><span class="cx"> return exec->vm().throwException(exec, createTypeError(exec, ASCIILiteral("No default value")));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+JSValue JSObject::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
+{
+ return object->ordinaryToPrimitive(exec, hint);
+}
+
+JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+{
+ JSValue value = callToPrimitiveFunction<TypeHintMode::TakesHint>(exec, this, exec->propertyNames().toPrimitiveSymbol, preferredType);
+ if (value)
+ return value;
+
+ return this->methodTable(exec->vm())->defaultValue(this, exec, preferredType);
+}
+
+bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result) const
+{
+ result = toPrimitive(exec, PreferNumber);
+ number = result.toNumber(exec);
+ return !result.isString();
+}
+
</ins><span class="cx"> const HashTableValue* JSObject::findPropertyHashEntry(PropertyName propertyName) const
</span><span class="cx"> {
</span><span class="cx"> for (const ClassInfo* info = classInfo(); info; info = info->parentClass) {
</span><span class="lines">@@ -2912,11 +2945,6 @@
</span><span class="cx"> return object->defineOwnNonIndexProperty(exec, propertyName, descriptor, throwException);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JSObject* throwTypeError(ExecState* exec, const String& message)
-{
- return exec->vm().throwException(exec, createTypeError(exec, message));
-}
-
</del><span class="cx"> void JSObject::convertToDictionary(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> DeferredStructureTransitionWatchpointFire deferredWatchpointFire;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -504,6 +504,7 @@
</span><span class="cx"> JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
</span><ins>+ JS_EXPORT_PRIVATE JSValue ordinaryToPrimitive(ExecState*, PreferredPrimitiveType) const;
</ins><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE bool hasInstance(ExecState*, JSValue value, JSValue hasInstanceValue);
</span><span class="cx"> bool hasInstance(ExecState*, JSValue);
</span><span class="lines">@@ -517,7 +518,7 @@
</span><span class="cx"> JS_EXPORT_PRIVATE static void getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
</span><span class="cx"> JS_EXPORT_PRIVATE static void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
</span><span class="cx">
</span><del>- JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
</del><ins>+ JS_EXPORT_PRIVATE JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
</ins><span class="cx"> bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
</span><span class="cx"> JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
</span><span class="cx"> JS_EXPORT_PRIVATE JSString* toString(ExecState*) const;
</span><span class="lines">@@ -1452,11 +1453,6 @@
</span><span class="cx"> putDirect(vm, offset, value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
-{
- return methodTable()->defaultValue(this, exec, preferredType);
-}
-
</del><span class="cx"> ALWAYS_INLINE JSObject* Register::object() const
</span><span class="cx"> {
</span><span class="cx"> return asObject(jsValue());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSmallStringsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SmallStrings.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SmallStrings.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/SmallStrings.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #include <wtf/Noncopyable.h>
</span><span class="cx">
</span><span class="cx"> #define JSC_COMMON_STRINGS_EACH_NAME(macro) \
</span><ins>+ macro(default) \
</ins><span class="cx"> macro(boolean) \
</span><span class="cx"> macro(false) \
</span><span class="cx"> macro(function) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -56,11 +56,13 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void SymbolPrototype::finishCreation(VM& vm)
</del><ins>+void SymbolPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx"> Base::finishCreation(vm);
</span><span class="cx"> putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Symbol"), DontEnum | ReadOnly);
</span><span class="cx"> ASSERT(inherits(info()));
</span><ins>+
+ JSC_NATIVE_FUNCTION(vm.propertyNames->toPrimitiveSymbol, symbolProtoFuncValueOf, DontEnum | ReadOnly, 1);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool SymbolPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -38,10 +38,10 @@
</span><span class="cx"> typedef JSNonFinalObject Base;
</span><span class="cx"> static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</span><span class="cx">
</span><del>- static SymbolPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
</del><ins>+ static SymbolPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</ins><span class="cx"> {
</span><span class="cx"> SymbolPrototype* prototype = new (NotNull, allocateCell<SymbolPrototype>(vm.heap)) SymbolPrototype(vm, structure);
</span><del>- prototype->finishCreation(vm);
</del><ins>+ prototype->finishCreation(vm, globalObject);
</ins><span class="cx"> return prototype;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx">
</span><span class="cx"> protected:
</span><span class="cx"> SymbolPrototype(VM&, Structure*);
</span><del>- void finishCreation(VM&);
</del><ins>+ void finishCreation(VM&, JSGlobalObject*);
</ins><span class="cx">
</span><span class="cx"> private:
</span><span class="cx"> static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestses6yaml"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/es6.yaml (197530 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/es6.yaml 2016-03-04 00:39:41 UTC (rev 197530)
+++ trunk/Source/JavaScriptCore/tests/es6.yaml 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -971,7 +971,7 @@
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_CreateListFromArrayLike.js
</span><span class="cx"> cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_Date.prototype.toJSON.js
</span><del>- cmd: runES6 :fail
</del><ins>+ cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_get_calls_Error.prototype.toString.js
</span><span class="cx"> cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_Function.prototype.bind.js
</span><span class="lines">@@ -1009,13 +1009,13 @@
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_String.prototype.replace.js
</span><span class="cx"> cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_String.prototype.search.js
</span><del>- cmd: runES6 :fail
</del><ins>+ cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_get_calls_String.prototype.split.js
</span><span class="cx"> cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_String.raw.js
</span><span class="cx"> cmd: runES6 :normal
</span><span class="cx"> - path: es6/Proxy_internal_get_calls_ToPrimitive.js
</span><del>- cmd: runES6 :fail
</del><ins>+ cmd: runES6 :normal
</ins><span class="cx"> - path: es6/Proxy_internal_get_calls_ToPropertyDescriptor.js
</span><span class="cx"> cmd: runES6 :fail
</span><span class="cx"> - path: es6/Proxy_internal_getOwnPropertyDescriptor_calls_[[Set]].js
</span><span class="lines">@@ -1211,7 +1211,7 @@
</span><span class="cx"> - path: es6/well-known_symbols_Symbol.split.js
</span><span class="cx"> cmd: runES6 :fail
</span><span class="cx"> - path: es6/well-known_symbols_Symbol.toPrimitive.js
</span><del>- cmd: runES6 :fail
</del><ins>+ cmd: runES6 :normal
</ins><span class="cx"> - path: es6/well-known_symbols_Symbol.toStringTag.js
</span><span class="cx"> cmd: runES6 :normal
</span><span class="cx"> - path: es6/well-known_symbols_Symbol.toStringTag_misc._built-ins.js
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressdatesymboltoprimitivejs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/date-symbol-toprimitive.js (0 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/date-symbol-toprimitive.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/date-symbol-toprimitive.js 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -0,0 +1,6 @@
</span><ins>+delete Date.prototype[Symbol.toPrimitive]
+
+let date = new Date();
+
+if (typeof (date + 1) !== "number")
+ throw "symbol was not deleted";
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressropessymboltoprimitivejs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ropes-symbol-toprimitive.js (0 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ropes-symbol-toprimitive.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ropes-symbol-toprimitive.js 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+function ropify(a,b,c) {
+ return a + b + c;
+}
+noInline(ropify);
+
+function ropify2(a,b,c) {
+ return a + b + c;
+}
+noInline(ropify2);
+
+let test = new String("test");
+
+for (let i = 0; i < 100000; i++) {
+ if (ropify("a", "b", test) !== "abtest")
+ throw "wrong on warmup";
+}
+
+String.prototype[Symbol.toPrimitive] = function() { return "changed"; }
+
+if (ropify("a", "b", test) !== "abchanged")
+ throw "watchpoint didn't fire";
+
+
+// Test we don't start doing the wrong thing if the prototype chain has been mucked with.
+for (let i = 0; i < 100000; i++) {
+ if (ropify2("a", "b", test) !== "abchanged")
+ throw "wrong on warmup";
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresssymboltoprimitivejs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/symbol-toprimitive.js (0 => 197531)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/symbol-toprimitive.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/symbol-toprimitive.js 2016-03-04 00:47:55 UTC (rev 197531)
</span><span class="lines">@@ -0,0 +1,18 @@
</span><ins>+// return object
+let foo = { }
+foo[Symbol.toPrimitive] = function() { return {} };
+
+for (i = 0; i < 100000; i++) {
+ let failed = true;
+ try {
+ foo >= 1;
+ } catch (e) {
+ if (e instanceof TypeError)
+ failed = false;
+ }
+
+ if (failed)
+ throw "should have thrown on return of object";
+}
+
+// The general use of Symbol.toPrimitive is covered in the ES6 tests.
</ins></span></pre>
</div>
</div>
</body>
</html>