<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197646] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197646">197646</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2016-03-06 15:12:08 -0800 (Sun, 06 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/197645">r197645</a>.
https://bugs.webkit.org/show_bug.cgi?id=155097
"Doesn't build properly when building entire webkit"
(Requested by saamyjoon on #webkit).
Reverted changeset:
"[[GetPrototypeOf]] should be a fully virtual method in the
method table"
https://bugs.webkit.org/show_bug.cgi?id=155002
http://trac.webkit.org/changeset/197645</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreAPIJSObjectRefcpp">trunk/Source/JavaScriptCore/API/JSObjectRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationsh">trunk/Source/JavaScriptCore/jit/JITOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeClassInfoh">trunk/Source/JavaScriptCore/runtime/ClassInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp">trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctionh">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValuecpp">trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellh">trunk/Source/JavaScriptCore/runtime/JSCell.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmentcpp">trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectInlinesh">trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSProxycpp">trunk/Source/JavaScriptCore/runtime/JSProxy.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectPrototypecpp">trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjectcpp">trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureInlinesh">trunk/Source/JavaScriptCore/runtime/StructureInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressproxyhaspropertyjs">trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreAPIJSObjectRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSObjectRef.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/API/JSObjectRef.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -267,8 +267,8 @@
</span><span class="cx"> ExecState* exec = toJS(ctx);
</span><span class="cx"> JSLockHolder locker(exec);
</span><span class="cx">
</span><del>- JSObject* jsObject = toJS(object);
- return toRef(exec, jsObject->getPrototypeDirect());
</del><ins>+ JSObject* jsObject = toJS(object);
+ return toRef(exec, jsObject->prototype());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2016-03-06 Commit Queue <commit-queue@webkit.org>
+
+ Unreviewed, rolling out r197645.
+ https://bugs.webkit.org/show_bug.cgi?id=155097
+
+ "Doesn't build properly when building entire webkit"
+ (Requested by saamyjoon on #webkit).
+
+ Reverted changeset:
+
+ "[[GetPrototypeOf]] should be a fully virtual method in the
+ method table"
+ https://bugs.webkit.org/show_bug.cgi?id=155002
+ http://trac.webkit.org/changeset/197645
+
</ins><span class="cx"> 2016-03-06 Saam barati <sbarati@apple.com>
</span><span class="cx">
</span><span class="cx"> [[GetPrototypeOf]] should be a fully virtual method in the method table
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1392,15 +1392,6 @@
</span><span class="cx"> return tryConvertToInt52(value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-size_t JIT_OPERATION operationDefaultHasInstance(ExecState* exec, JSCell* value, JSCell* proto) // Returns jsBoolean(True|False) on 64-bit.
-{
- VM* vm = &exec->vm();
- NativeCallFrameTracer tracer(vm, exec);
- if (JSObject::defaultHasInstance(exec, value, proto))
- return 1;
- return 0;
-}
-
</del><span class="cx"> void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx"> exec->vm().typeProfilerLog()->processLogEntries(ASCIILiteral("Log Full, called from inside DFG."));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -155,8 +155,6 @@
</span><span class="cx"> int64_t JIT_OPERATION operationConvertBoxedDoubleToInt52(EncodedJSValue);
</span><span class="cx"> int64_t JIT_OPERATION operationConvertDoubleToInt52(double);
</span><span class="cx">
</span><del>-size_t JIT_OPERATION operationDefaultHasInstance(ExecState*, JSCell* value, JSCell* proto);
-
</del><span class="cx"> void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState*) WTF_INTERNAL;
</span><span class="cx">
</span><span class="cx"> void JIT_OPERATION debugOperationPrintSpeculationFailure(ExecState*, void*, void*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -2740,8 +2740,6 @@
</span><span class="cx">
</span><span class="cx"> // Walk up the prototype chain of the value (in scratchReg), comparing to prototypeReg.
</span><span class="cx"> MacroAssembler::Label loop(&m_jit);
</span><del>- MacroAssembler::Jump performDefaultHasInstance = m_jit.branch8(MacroAssembler::Equal,
- MacroAssembler::Address(scratchReg, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType));
</del><span class="cx"> m_jit.emitLoadStructure(scratchReg, scratchReg, scratch2Reg);
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(scratchReg, Structure::prototypeOffset() + CellPayloadOffset), scratchReg);
</span><span class="cx"> MacroAssembler::Jump isInstance = m_jit.branchPtr(MacroAssembler::Equal, scratchReg, prototypeReg);
</span><span class="lines">@@ -2757,18 +2755,7 @@
</span><span class="cx"> #else
</span><span class="cx"> m_jit.move(MacroAssembler::TrustedImm32(0), scratchReg);
</span><span class="cx"> #endif
</span><del>- MacroAssembler::JumpList doneJumps;
- doneJumps.append(m_jit.jump());
-
- performDefaultHasInstance.link(&m_jit);
- silentSpillAllRegisters(scratchReg);
- callOperation(operationDefaultHasInstance, scratchReg, valueReg, prototypeReg);
- silentFillAllRegisters(scratchReg);
- m_jit.exceptionCheck();
-#if USE(JSVALUE64)
- m_jit.or32(TrustedImm32(ValueFalse), scratchReg);
-#endif
- doneJumps.append(m_jit.jump());
</del><ins>+ MacroAssembler::Jump putResult = m_jit.jump();
</ins><span class="cx">
</span><span class="cx"> isInstance.link(&m_jit);
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="lines">@@ -2777,7 +2764,7 @@
</span><span class="cx"> m_jit.move(MacroAssembler::TrustedImm32(1), scratchReg);
</span><span class="cx"> #endif
</span><span class="cx">
</span><del>- doneJumps.link(&m_jit);
</del><ins>+ putResult.link(&m_jit);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void SpeculativeJIT::compileCheckTypeInfoFlags(Node* node)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -5947,8 +5947,6 @@
</span><span class="cx"> LBasicBlock loop = FTL_NEW_BLOCK(m_out, ("InstanceOf loop"));
</span><span class="cx"> LBasicBlock notYetInstance = FTL_NEW_BLOCK(m_out, ("InstanceOf not yet instance"));
</span><span class="cx"> LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("InstanceOf continuation"));
</span><del>- LBasicBlock loadPrototypeDirect = FTL_NEW_BLOCK(m_out, ("Instanceof defaultPrototypeFunction"));
- LBasicBlock defaultHasInstanceSlow = FTL_NEW_BLOCK(m_out, ("Instanceof defaultPrototypeFunction"));
</del><span class="cx">
</span><span class="cx"> LValue condition;
</span><span class="cx"> if (m_node->child1().useKind() == UntypedUse)
</span><span class="lines">@@ -5966,14 +5964,8 @@
</span><span class="cx"> ValueFromBlock originalValue = m_out.anchor(cell);
</span><span class="cx"> m_out.jump(loop);
</span><span class="cx">
</span><del>- m_out.appendTo(loop, loadPrototypeDirect);
</del><ins>+ m_out.appendTo(loop, notYetInstance);
</ins><span class="cx"> LValue value = m_out.phi(m_out.int64, originalValue);
</span><del>- LValue type = m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType);
- m_out.branch(
- m_out.notEqual(type, m_out.constInt32(ProxyObjectType)),
- usually(loadPrototypeDirect), rarely(defaultHasInstanceSlow));
-
- m_out.appendTo(loadPrototypeDirect, notYetInstance);
</del><span class="cx"> LValue structure = loadStructure(value);
</span><span class="cx"> LValue currentPrototype = m_out.load64(structure, m_heaps.Structure_prototype);
</span><span class="cx"> ValueFromBlock isInstanceResult = m_out.anchor(m_out.booleanTrue);
</span><span class="lines">@@ -5981,22 +5973,14 @@
</span><span class="cx"> m_out.equal(currentPrototype, prototype),
</span><span class="cx"> unsure(continuation), unsure(notYetInstance));
</span><span class="cx">
</span><del>- m_out.appendTo(notYetInstance, defaultHasInstanceSlow);
</del><ins>+ m_out.appendTo(notYetInstance, continuation);
</ins><span class="cx"> ValueFromBlock notInstanceResult = m_out.anchor(m_out.booleanFalse);
</span><span class="cx"> m_out.addIncomingToPhi(value, m_out.anchor(currentPrototype));
</span><span class="cx"> m_out.branch(isCell(currentPrototype), unsure(loop), unsure(continuation));
</span><del>-
- m_out.appendTo(defaultHasInstanceSlow, continuation);
- // We can use the value that we're looping with because we
- // can just continue off from wherever we bailed from the
- // loop.
- ValueFromBlock defaultHasInstanceResult = m_out.anchor(
- vmCall(m_out.boolean, m_out.operation(operationDefaultHasInstance), m_callFrame, value, prototype));
- m_out.jump(continuation);
</del><span class="cx">
</span><span class="cx"> m_out.appendTo(continuation, lastNext);
</span><span class="cx"> setBoolean(
</span><del>- m_out.phi(m_out.boolean, notCellResult, isInstanceResult, notInstanceResult, defaultHasInstanceResult));
</del><ins>+ m_out.phi(m_out.boolean, notCellResult, isInstanceResult, notInstanceResult));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileInstanceOfCustom()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -153,8 +153,6 @@
</span><span class="cx"> move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
</span><span class="cx"> Label loop(this);
</span><span class="cx">
</span><del>- addSlowCase(branch8(Equal, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType)));
-
</del><span class="cx"> // Load the prototype of the object in regT2. If this is equal to regT1 - WIN!
</span><span class="cx"> // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
</span><span class="cx"> emitLoadStructure(regT2, regT2, regT3);
</span><span class="lines">@@ -859,7 +857,6 @@
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, value);
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, proto);
</span><span class="cx"> linkSlowCase(iter);
</span><del>- linkSlowCase(iter);
</del><span class="cx"> emitGetVirtualRegister(value, regT0);
</span><span class="cx"> emitGetVirtualRegister(proto, regT1);
</span><span class="cx"> callOperation(operationInstanceOf, dst, regT0, regT1);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -233,8 +233,6 @@
</span><span class="cx"> move(TrustedImm32(1), regT0);
</span><span class="cx"> Label loop(this);
</span><span class="cx">
</span><del>- addSlowCase(branch8(Equal, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType)));
-
</del><span class="cx"> // Load the prototype of the cell in regT2. If this is equal to regT1 - WIN!
</span><span class="cx"> // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
</span><span class="cx"> loadPtr(Address(regT2, JSCell::structureIDOffset()), regT2);
</span><span class="lines">@@ -265,7 +263,6 @@
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, value);
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, proto);
</span><span class="cx"> linkSlowCase(iter);
</span><del>- linkSlowCase(iter);
</del><span class="cx">
</span><span class="cx"> emitLoad(value, regT1, regT0);
</span><span class="cx"> emitLoad(proto, regT3, regT2);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1779,6 +1779,8 @@
</span><span class="cx"> JSValue value = JSValue::decode(encodedValue);
</span><span class="cx"> JSValue proto = JSValue::decode(encodedProto);
</span><span class="cx">
</span><ins>+ ASSERT(!value.isObject() || !proto.isObject());
+
</ins><span class="cx"> bool result = JSObject::defaultHasInstance(exec, value, proto);
</span><span class="cx"> return JSValue::encode(jsBoolean(result));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -196,7 +196,6 @@
</span><span class="cx"> typedef int32_t JIT_OPERATION (*Z_JITOperation_D)(double);
</span><span class="cx"> typedef int32_t JIT_OPERATION (*Z_JITOperation_E)(ExecState*);
</span><span class="cx"> typedef int32_t JIT_OPERATION (*Z_JITOperation_EC)(ExecState*, JSCell*);
</span><del>-typedef int32_t JIT_OPERATION (*Z_JITOperation_ECC)(ExecState*, JSCell*, JSCell*);
</del><span class="cx"> typedef int32_t JIT_OPERATION (*Z_JITOperation_EGC)(ExecState*, JSGlobalObject*, JSCell*);
</span><span class="cx"> typedef int32_t JIT_OPERATION (*Z_JITOperation_ESJss)(ExecState*, size_t, JSString*);
</span><span class="cx"> typedef int32_t JIT_OPERATION (*Z_JITOperation_EJ)(ExecState*, EncodedJSValue);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/jsc.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1228,7 +1228,7 @@
</span><span class="cx"> if (!target.isObject())
</span><span class="cx"> return JSValue::encode(jsUndefined());
</span><span class="cx"> JSObject* jsTarget = asObject(target.asCell());
</span><del>- Structure* structure = JSProxy::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsTarget->getPrototypeDirect());
</del><ins>+ Structure* structure = JSProxy::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsTarget->prototype());
</ins><span class="cx"> JSProxy* proxy = JSProxy::create(exec->vm(), structure, jsTarget);
</span><span class="cx"> return JSValue::encode(proxy);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -526,6 +526,7 @@
</span><span class="cx"> LLINT_BEGIN();
</span><span class="cx"> JSValue value = LLINT_OP_C(2).jsValue();
</span><span class="cx"> JSValue proto = LLINT_OP_C(3).jsValue();
</span><ins>+ ASSERT(!value.isObject() || !proto.isObject());
</ins><span class="cx"> LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1706,12 +1706,7 @@
</span><span class="cx"> callSlowPath(_slow_path_copy_rest)
</span><span class="cx"> dispatch(4)
</span><span class="cx">
</span><del>-_llint_op_instanceof:
- traceExecution()
- callSlowPath(_llint_slow_path_instanceof)
- dispatch(4)
</del><span class="cx">
</span><del>-
</del><span class="cx"> # Lastly, make sure that we can link even though we don't support all opcodes.
</span><span class="cx"> # These opcodes should never arise when using LLInt or either JIT. We assert
</span><span class="cx"> # as much.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1206,6 +1206,34 @@
</span><span class="cx"> storei 1, PayloadOffset[cfr, t3, 8]
</span><span class="cx"> dispatch(4)
</span><span class="cx">
</span><ins>+_llint_op_instanceof:
+ traceExecution()
+ # Actually do the work.
+ loadi 12[PC], t0
+ loadi 4[PC], t3
+ loadConstantOrVariablePayload(t0, CellTag, t1, .opInstanceofSlow)
+ bbb JSCell::m_type[t1], ObjectType, .opInstanceofSlow
+ loadi 8[PC], t0
+ loadConstantOrVariablePayload(t0, CellTag, t2, .opInstanceofSlow)
+
+ # Register state: t1 = prototype, t2 = value
+ move 1, t0
+.opInstanceofLoop:
+ loadp JSCell::m_structureID[t2], t2
+ loadi Structure::m_prototype + PayloadOffset[t2], t2
+ bpeq t2, t1, .opInstanceofDone
+ btinz t2, .opInstanceofLoop
+
+ move 0, t0
+.opInstanceofDone:
+ storei BooleanTag, TagOffset[cfr, t3, 8]
+ storei t0, PayloadOffset[cfr, t3, 8]
+ dispatch(4)
+
+.opInstanceofSlow:
+ callSlowPath(_llint_slow_path_instanceof)
+ dispatch(4)
+
</ins><span class="cx"> _llint_op_instanceof_custom:
</span><span class="cx"> traceExecution()
</span><span class="cx"> callSlowPath(_llint_slow_path_instanceof_custom)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -1093,6 +1093,34 @@
</span><span class="cx"> dispatch(4)
</span><span class="cx">
</span><span class="cx">
</span><ins>+_llint_op_instanceof:
+ traceExecution()
+ # Actually do the work.
+ loadisFromInstruction(3, t0)
+ loadConstantOrVariableCell(t0, t1, .opInstanceofSlow)
+ bbb JSCell::m_type[t1], ObjectType, .opInstanceofSlow
+ loadisFromInstruction(2, t0)
+ loadConstantOrVariableCell(t0, t2, .opInstanceofSlow)
+
+ # Register state: t1 = prototype, t2 = value
+ move 1, t0
+.opInstanceofLoop:
+ loadStructureAndClobberFirstArg(t2, t3)
+ loadq Structure::m_prototype[t3], t2
+ bqeq t2, t1, .opInstanceofDone
+ btqz t2, tagMask, .opInstanceofLoop
+
+ move 0, t0
+.opInstanceofDone:
+ orq ValueFalse, t0
+ loadisFromInstruction(1, t3)
+ storeq t0, [cfr, t3, 8]
+ dispatch(4)
+
+.opInstanceofSlow:
+ callSlowPath(_llint_slow_path_instanceof)
+ dispatch(4)
+
</ins><span class="cx"> _llint_op_instanceof_custom:
</span><span class="cx"> traceExecution()
</span><span class="cx"> callSlowPath(_llint_slow_path_instanceof_custom)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx"> // Fast path in the normal case where the user has not set an own constructor and the Array.prototype.constructor is normal.
</span><span class="cx"> // We need prototype check for subclasses of Array, which are Array objects but have a different prototype by default.
</span><span class="cx"> if (LIKELY(!thisObject->hasCustomProperties()
</span><del>- && thisObject->globalObject()->arrayPrototype() == thisObject->getPrototypeDirect()
</del><ins>+ && thisObject->globalObject()->arrayPrototype() == thisObject->prototype()
</ins><span class="cx"> && !thisObject->globalObject()->arrayPrototype()->didChangeConstructorOrSpeciesProperties()))
</span><span class="cx"> return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeClassInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ClassInfo.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ClassInfo.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/ClassInfo.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -112,9 +112,6 @@
</span><span class="cx"> typedef bool (*SetPrototypeFunctionPtr)(JSObject*, ExecState*, JSValue, bool shouldThrowIfCantSet);
</span><span class="cx"> SetPrototypeFunctionPtr setPrototype;
</span><span class="cx">
</span><del>- typedef JSValue (*GetPrototypeFunctionPtr)(JSObject*, ExecState*);
- GetPrototypeFunctionPtr getPrototype;
-
</del><span class="cx"> typedef void (*DumpToStreamFunctionPtr)(const JSCell*, PrintStream&);
</span><span class="cx"> DumpToStreamFunctionPtr dumpToStream;
</span><span class="cx">
</span><span class="lines">@@ -169,7 +166,6 @@
</span><span class="cx"> &ClassName::preventExtensions, \
</span><span class="cx"> &ClassName::isExtensible, \
</span><span class="cx"> &ClassName::setPrototype, \
</span><del>- &ClassName::getPrototype, \
</del><span class="cx"> &ClassName::dumpToStream, \
</span><span class="cx"> &ClassName::estimatedSize \
</span><span class="cx"> }, \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -168,7 +168,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JSString* name = target.get(exec, exec->propertyNames().name).toString(exec);
</span><del>- return JSValue::encode(JSBoundFunction::create(vm, exec, globalObject, targetObject, exec->argument(0), boundArgs, length, name->value(exec)));
</del><ins>+ return JSValue::encode(JSBoundFunction::create(vm, globalObject, targetObject, exec->argument(0), boundArgs, length, name->value(exec)));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -129,9 +129,7 @@
</span><span class="cx"> return JSValue::encode(throwOutOfMemoryError(state));
</span><span class="cx">
</span><span class="cx"> // c. Let bc be BoundFunctionCreate(F, «this value»).
</span><del>- boundCompare = JSBoundFunction::create(vm, state, globalObject, targetObject, collator, boundArgs, 2, ASCIILiteral("compare"));
- if (vm.exception())
- return JSValue::encode(JSValue());
</del><ins>+ boundCompare = JSBoundFunction::create(vm, globalObject, targetObject, collator, boundArgs, 2, ASCIILiteral("compare"));
</ins><span class="cx"> // d. Set collator.[[boundCompare]] to bc.
</span><span class="cx"> collator->setBoundCompare(vm, boundCompare);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -134,9 +134,7 @@
</span><span class="cx"> return JSValue::encode(throwOutOfMemoryError(state));
</span><span class="cx">
</span><span class="cx"> // c. Let bf be BoundFunctionCreate(F, «this value»).
</span><del>- boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, dtf, boundArgs, 1, ASCIILiteral("format"));
- if (vm.exception())
- return JSValue::encode(JSValue());
</del><ins>+ boundFormat = JSBoundFunction::create(vm, globalObject, targetObject, dtf, boundArgs, 1, ASCIILiteral("format"));
</ins><span class="cx"> // d. Set dtf.[[boundFormat]] to bf.
</span><span class="cx"> dtf->setBoundFormat(vm, boundFormat);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -122,9 +122,7 @@
</span><span class="cx"> return JSValue::encode(throwOutOfMemoryError(state));
</span><span class="cx">
</span><span class="cx"> // c. Let bf be BoundFunctionCreate(F, «this value»).
</span><del>- boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, nf, boundArgs, 1, ASCIILiteral("format"));
- if (vm.exception())
- return JSValue::encode(JSValue());
</del><ins>+ boundFormat = JSBoundFunction::create(vm, globalObject, targetObject, nf, boundArgs, 1, ASCIILiteral("format"));
</ins><span class="cx"> // d. Set nf.[[boundFormat]] to bf.
</span><span class="cx"> nf->setBoundFormat(vm, boundFormat);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -87,11 +87,9 @@
</span><span class="cx"> return JSValue::encode(jsBoolean(boundObject->targetFunction()->hasInstance(exec, value)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline Structure* getBoundFunctionStructure(VM& vm, ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction)
</del><ins>+inline Structure* getBoundFunctionStructure(VM& vm, JSGlobalObject* globalObject, JSObject* targetFunction)
</ins><span class="cx"> {
</span><del>- JSValue prototype = targetFunction->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
- return nullptr;
</del><ins>+ JSValue prototype = targetFunction->structure(vm)->storedPrototype();
</ins><span class="cx"> JSFunction* targetJSFunction = jsDynamicCast<JSFunction*>(targetFunction);
</span><span class="cx">
</span><span class="cx"> // We only cache the structure of the bound function if the bindee is a JSFunction since there
</span><span class="lines">@@ -119,15 +117,13 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JSBoundFunction* JSBoundFunction::create(VM& vm, ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const String& name)
</del><ins>+JSBoundFunction* JSBoundFunction::create(VM& vm, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const String& name)
</ins><span class="cx"> {
</span><span class="cx"> ConstructData constructData;
</span><span class="cx"> ConstructType constructType = JSC::getConstructData(targetFunction, constructData);
</span><span class="cx"> bool canConstruct = constructType != ConstructType::None;
</span><span class="cx"> NativeExecutable* executable = vm.getHostFunction(boundFunctionCall, canConstruct ? boundFunctionConstruct : callHostFunctionAsConstructor, ASCIILiteral("Function.prototype.bind result"));
</span><del>- Structure* structure = getBoundFunctionStructure(vm, exec, globalObject, targetFunction);
- if (UNLIKELY(vm.exception()))
- return nullptr;
</del><ins>+ Structure* structure = getBoundFunctionStructure(vm, globalObject, targetFunction);
</ins><span class="cx"> JSBoundFunction* function = new (NotNull, allocateCell<JSBoundFunction>(vm.heap)) JSBoundFunction(vm, globalObject, structure, targetFunction, boundThis, boundArgs);
</span><span class="cx">
</span><span class="cx"> function->finishCreation(vm, executable, length, makeString("bound ", name));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx"> typedef JSFunction Base;
</span><span class="cx"> const static unsigned StructureFlags = ~ImplementsDefaultHasInstance & Base::StructureFlags;
</span><span class="cx">
</span><del>- static JSBoundFunction* create(VM&, ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const String&);
</del><ins>+ static JSBoundFunction* create(VM&, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const String&);
</ins><span class="cx">
</span><span class="cx"> static bool customHasInstance(JSObject*, ExecState*, JSValue);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCJSValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -143,7 +143,7 @@
</span><span class="cx"> JSValue prototype;
</span><span class="cx"> if (propertyName != exec->propertyNames().underscoreProto) {
</span><span class="cx"> for (; !obj->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
</span><del>- prototype = obj->getPrototypeDirect();
</del><ins>+ prototype = obj->prototype();
</ins><span class="cx"> if (prototype.isNull()) {
</span><span class="cx"> if (slot.isStrictMode())
</span><span class="cx"> throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="lines">@@ -178,9 +178,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- prototype = obj->getPrototype(vm, exec);
- if (vm.exception())
- return;
</del><ins>+ prototype = obj->prototype();
</ins><span class="cx"> if (prototype.isNull())
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -285,9 +285,4 @@
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JSValue JSCell::getPrototype(JSObject*, ExecState*)
-{
- RELEASE_ASSERT_NOT_REACHED();
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -209,7 +209,6 @@
</span><span class="cx"> static NO_RETURN_DUE_TO_CRASH bool preventExtensions(JSObject*, ExecState*);
</span><span class="cx"> static NO_RETURN_DUE_TO_CRASH bool isExtensible(JSObject*, ExecState*);
</span><span class="cx"> static NO_RETURN_DUE_TO_CRASH bool setPrototype(JSObject*, ExecState*, JSValue, bool);
</span><del>- static NO_RETURN_DUE_TO_CRASH JSValue getPrototype(JSObject*, ExecState*);
</del><span class="cx">
</span><span class="cx"> static String className(const JSObject*);
</span><span class="cx"> JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -613,7 +613,7 @@
</span><span class="cx"> putDirectWithoutTransition(vm, Identifier::fromString(exec, "$vm"), dollarVM, DontEnum);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- resetPrototype(vm, getPrototypeDirect());
</del><ins>+ resetPrototype(vm, prototype());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSGlobalObject::hasLegacyProfiler() const
</span><span class="lines">@@ -669,8 +669,8 @@
</span><span class="cx"> static inline JSObject* lastInPrototypeChain(JSObject* object)
</span><span class="cx"> {
</span><span class="cx"> JSObject* o = object;
</span><del>- while (o->getPrototypeDirect().isObject())
- o = asObject(o->getPrototypeDirect());
</del><ins>+ while (o->prototype().isObject())
+ o = asObject(o->prototype());
</ins><span class="cx"> return o;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -726,7 +726,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- JSValue prototypeValue = current->getPrototypeDirect();
</del><ins>+ JSValue prototypeValue = current->prototype();
</ins><span class="cx"> if (prototypeValue.isNull())
</span><span class="cx"> break;
</span><span class="cx"> current = asObject(prototypeValue);
</span><span class="lines">@@ -785,20 +785,20 @@
</span><span class="cx"> bool JSGlobalObject::objectPrototypeIsSane()
</span><span class="cx"> {
</span><span class="cx"> return !hasIndexedProperties(m_objectPrototype->indexingType())
</span><del>- && m_objectPrototype->getPrototypeDirect().isNull();
</del><ins>+ && m_objectPrototype->prototype().isNull();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSGlobalObject::arrayPrototypeChainIsSane()
</span><span class="cx"> {
</span><span class="cx"> return !hasIndexedProperties(m_arrayPrototype->indexingType())
</span><del>- && m_arrayPrototype->getPrototypeDirect() == m_objectPrototype.get()
</del><ins>+ && m_arrayPrototype->prototype() == m_objectPrototype.get()
</ins><span class="cx"> && objectPrototypeIsSane();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSGlobalObject::stringPrototypeChainIsSane()
</span><span class="cx"> {
</span><span class="cx"> return !hasIndexedProperties(m_stringPrototype->indexingType())
</span><del>- && m_stringPrototype->getPrototypeDirect() == m_objectPrototype.get()
</del><ins>+ && m_stringPrototype->prototype() == m_objectPrototype.get()
</ins><span class="cx"> && objectPrototypeIsSane();
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -379,7 +379,7 @@
</span><span class="cx"> structure()->setGlobalObject(vm, this);
</span><span class="cx"> m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
</span><span class="cx"> init(vm);
</span><del>- setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(), PureForwardingProxyType), this));
</del><ins>+ setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype(), PureForwardingProxyType), this));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void finishCreation(VM& vm, JSObject* thisValue)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -784,9 +784,8 @@
</span><span class="cx">
</span><span class="cx"> class GlobalFuncProtoGetterFunctor {
</span><span class="cx"> public:
</span><del>- GlobalFuncProtoGetterFunctor(ExecState* exec, JSObject* thisObject)
- : m_exec(exec)
- , m_hasSkippedFirstFrame(false)
</del><ins>+ GlobalFuncProtoGetterFunctor(JSObject* thisObject)
+ : m_hasSkippedFirstFrame(false)
</ins><span class="cx"> , m_thisObject(thisObject)
</span><span class="cx"> , m_result(JSValue::encode(jsUndefined()))
</span><span class="cx"> {
</span><span class="lines">@@ -802,13 +801,12 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (m_thisObject->allowsAccessFrom(visitor->callFrame()))
</span><del>- m_result = JSValue::encode(m_thisObject->getPrototype(m_exec->vm(), m_exec));
</del><ins>+ m_result = JSValue::encode(m_thisObject->prototype());
</ins><span class="cx">
</span><span class="cx"> return StackVisitor::Done;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- ExecState* m_exec;
</del><span class="cx"> bool m_hasSkippedFirstFrame;
</span><span class="cx"> JSObject* m_thisObject;
</span><span class="cx"> EncodedJSValue m_result;
</span><span class="lines">@@ -824,10 +822,7 @@
</span><span class="cx"> if (!thisObject)
</span><span class="cx"> return JSValue::encode(exec->thisValue().synthesizePrototype(exec));
</span><span class="cx">
</span><del>- GlobalFuncProtoGetterFunctor functor(exec, thisObject);
- // This can throw but it's just unneeded extra work to check for it. The return
- // value from this function is only used as the return value from a host call.
- // Therefore, the return value is only used if there wasn't an exception.
</del><ins>+ GlobalFuncProtoGetterFunctor functor(thisObject);
</ins><span class="cx"> exec->iterate(functor);
</span><span class="cx"> return functor.result();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -76,7 +76,7 @@
</span><span class="cx"> // We don't call through to JSObject because there's no way to give a
</span><span class="cx"> // lexical environment object getter properties or a prototype.
</span><span class="cx"> ASSERT(!thisObject->hasGetterSetterProperties());
</span><del>- ASSERT(thisObject->getPrototypeDirect().isNull());
</del><ins>+ ASSERT(thisObject->prototype().isNull());
</ins><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -272,7 +272,7 @@
</span><span class="cx"> {
</span><span class="cx"> String prototypeFunctionName;
</span><span class="cx"> ExecState* exec = object->globalObject()->globalExec();
</span><del>- PropertySlot slot(object->getPrototypeDirect(), PropertySlot::InternalMethodType::VMInquiry);
</del><ins>+ PropertySlot slot(object->structure()->storedPrototype(), PropertySlot::InternalMethodType::VMInquiry);
</ins><span class="cx"> PropertyName constructor(exec->propertyNames().constructor);
</span><span class="cx"> if (object->getPropertySlot(exec, constructor, slot)) {
</span><span class="cx"> if (slot.isValue()) {
</span><span class="lines">@@ -430,14 +430,11 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> if (obj->type() == ProxyObjectType && propertyName != vm.propertyNames->underscoreProto) {
</span><del>- // FIXME: We shouldn't unconditionally perform [[Set]] here.
- // We need to do more because this is observable behavior.
- // https://bugs.webkit.org/show_bug.cgi?id=155012
</del><span class="cx"> ProxyObject* proxy = jsCast<ProxyObject*>(obj);
</span><span class="cx"> proxy->ProxyObject::put(proxy, exec, propertyName, value, slot);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>- JSValue prototype = obj->getPrototypeDirect();
</del><ins>+ JSValue prototype = obj->prototype();
</ins><span class="cx"> if (prototype.isNull())
</span><span class="cx"> break;
</span><span class="cx"> obj = asObject(prototype);
</span><span class="lines">@@ -1204,7 +1201,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(methodTable(vm)->toThis(this, exec, NotStrictMode) == this);
</span><span class="cx">
</span><del>- if (this->getPrototypeDirect() == prototype)
</del><ins>+ if (this->prototype() == prototype)
</ins><span class="cx"> return true;
</span><span class="cx">
</span><span class="cx"> bool isExtensible = this->isExtensible(exec);
</span><span class="lines">@@ -1218,16 +1215,13 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JSValue nextPrototype = prototype;
</span><del>- MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
</del><span class="cx"> while (nextPrototype && nextPrototype.isObject()) {
</span><span class="cx"> if (nextPrototype == this) {
</span><span class="cx"> if (shouldThrowIfCantSet)
</span><span class="cx"> vm.throwException(exec, createError(exec, ASCIILiteral("cyclic __proto__ value")));
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><del>- if (UNLIKELY(asObject(nextPrototype)->methodTable(vm)->getPrototype != defaultGetPrototype))
- break; // We're done. Set the prototype.
- nextPrototype = asObject(nextPrototype)->getPrototypeDirect();
</del><ins>+ nextPrototype = asObject(nextPrototype)->prototype();
</ins><span class="cx"> }
</span><span class="cx"> setPrototypeDirect(vm, prototype);
</span><span class="cx"> return true;
</span><span class="lines">@@ -1238,11 +1232,6 @@
</span><span class="cx"> return object->setPrototypeWithCycleCheck(exec->vm(), exec, prototype, shouldThrowIfCantSet);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JSValue JSObject::getPrototype(JSObject* object, ExecState*)
-{
- return object->getPrototypeDirect();
-}
-
</del><span class="cx"> bool JSObject::setPrototype(VM& vm, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
</span><span class="cx"> {
</span><span class="cx"> return methodTable(vm)->setPrototype(this, exec, prototype, shouldThrowIfCantSet);
</span><span class="lines">@@ -1583,19 +1572,12 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- VM& vm = exec->vm();
</del><span class="cx"> JSObject* object = asObject(value);
</span><del>- while (true) {
- JSValue objectValue = object->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
- return false;
- if (!objectValue.isObject())
- return false;
- object = asObject(objectValue);
</del><ins>+ while ((object = object->prototype().getObject())) {
</ins><span class="cx"> if (proto == object)
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><del>- ASSERT_NOT_REACHED();
</del><ins>+ return false;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectPrivateFuncInstanceOf(ExecState* exec)
</span><span class="lines">@@ -1608,29 +1590,24 @@
</span><span class="cx">
</span><span class="cx"> void JSObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
</span><span class="cx"> {
</span><del>- VM& vm = exec->vm();
- object->methodTable(vm)->getOwnPropertyNames(object, exec, propertyNames, mode);
- if (UNLIKELY(vm.exception()))
</del><ins>+ object->methodTable(exec->vm())->getOwnPropertyNames(object, exec, propertyNames, mode);
+ if (UNLIKELY(exec->hadException()))
</ins><span class="cx"> return;
</span><span class="cx">
</span><del>- JSValue nextProto = object->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
</del><ins>+ if (object->prototype().isNull())
</ins><span class="cx"> return;
</span><del>- if (nextProto.isNull())
- return;
</del><span class="cx">
</span><del>- JSObject* prototype = asObject(nextProto);
</del><ins>+ VM& vm = exec->vm();
+ JSObject* prototype = asObject(object->prototype());
</ins><span class="cx"> while(1) {
</span><span class="cx"> if (prototype->structure(vm)->typeInfo().overridesGetPropertyNames()) {
</span><span class="cx"> prototype->methodTable(vm)->getPropertyNames(prototype, exec, propertyNames, mode);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> prototype->methodTable(vm)->getOwnPropertyNames(prototype, exec, propertyNames, mode);
</span><del>- if (UNLIKELY(vm.exception()))
</del><ins>+ if (UNLIKELY(exec->hadException()))
</ins><span class="cx"> return;
</span><del>- nextProto = prototype->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
- return;
</del><ins>+ JSValue nextProto = prototype->prototype();
</ins><span class="cx"> if (nextProto.isNull())
</span><span class="cx"> break;
</span><span class="cx"> prototype = asObject(nextProto);
</span><span class="lines">@@ -2050,7 +2027,7 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- JSValue prototypeValue = current->getPrototypeDirect();
</del><ins>+ JSValue prototypeValue = current->prototype();
</ins><span class="cx"> if (prototypeValue.isNull())
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="lines">@@ -2060,7 +2037,7 @@
</span><span class="cx">
</span><span class="cx"> bool JSObject::attemptToInterceptPutByIndexOnHole(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><del>- JSValue prototypeValue = getPrototypeDirect();
</del><ins>+ JSValue prototypeValue = prototype();
</ins><span class="cx"> if (prototypeValue.isNull())
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="lines">@@ -3052,16 +3029,13 @@
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> object->methodTable(vm)->getOwnPropertyNames(object, exec, propertyNames, EnumerationMode(mode, JSObjectPropertiesMode::Exclude));
</span><del>- if (UNLIKELY(vm.exception()))
</del><ins>+ if (UNLIKELY(exec->hadException()))
</ins><span class="cx"> return;
</span><span class="cx">
</span><del>- JSValue nextProto = object->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
</del><ins>+ if (object->prototype().isNull())
</ins><span class="cx"> return;
</span><del>- if (nextProto.isNull())
- return;
</del><span class="cx">
</span><del>- JSObject* prototype = asObject(nextProto);
</del><ins>+ JSObject* prototype = asObject(object->prototype());
</ins><span class="cx"> while (true) {
</span><span class="cx"> if (prototype->structure(vm)->typeInfo().overridesGetPropertyNames()) {
</span><span class="cx"> prototype->methodTable(vm)->getPropertyNames(prototype, exec, propertyNames, mode);
</span><span class="lines">@@ -3070,9 +3044,7 @@
</span><span class="cx"> prototype->methodTable(vm)->getOwnPropertyNames(prototype, exec, propertyNames, mode);
</span><span class="cx"> if (UNLIKELY(exec->hadException()))
</span><span class="cx"> return;
</span><del>- nextProto = prototype->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
- return;
</del><ins>+ JSValue nextProto = prototype->prototype();
</ins><span class="cx"> if (nextProto.isNull())
</span><span class="cx"> break;
</span><span class="cx"> prototype = asObject(nextProto);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -103,19 +103,7 @@
</span><span class="cx"> JS_EXPORT_PRIVATE static String className(const JSObject*);
</span><span class="cx"> JS_EXPORT_PRIVATE static String calculatedClassName(JSObject*);
</span><span class="cx">
</span><del>- // This is the fully virtual [[GetPrototypeOf]] internal function defined
- // in the ECMAScript 6 specification. Use this when doing a [[GetPrototypeOf]]
- // operation as dictated in the specification.
- JSValue getPrototype(VM&, ExecState*);
- JS_EXPORT_PRIVATE static JSValue getPrototype(JSObject*, ExecState*);
- // This gets the prototype directly off of the structure. This does not do
- // dynamic dispatch on the getPrototype method table method. It is not valid
- // to use this when performing a [[GetPrototypeOf]] operation in the specification.
- // It is valid to use though when you know that you want to directly get it
- // without consulting the method table. This is akin to getting the [[Prototype]]
- // internal field directly as described in the specification.
- JSValue getPrototypeDirect() const;
-
</del><ins>+ JSValue prototype() const;
</ins><span class="cx"> // This sets the prototype without checking for cycles and without
</span><span class="cx"> // doing dynamic dispatch on [[SetPrototypeOf]] operation in the specification.
</span><span class="cx"> // It is not valid to use this when performing a [[SetPrototypeOf]] operation in
</span><span class="lines">@@ -771,7 +759,7 @@
</span><span class="cx"> {
</span><span class="cx"> Base::finishCreation(vm);
</span><span class="cx"> ASSERT(inherits(info()));
</span><del>- ASSERT(getPrototypeDirect().isNull() || Heap::heap(this) == Heap::heap(getPrototypeDirect()));
</del><ins>+ ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
</ins><span class="cx"> ASSERT(structure()->isObject());
</span><span class="cx"> ASSERT(classInfo());
</span><span class="cx"> }
</span><span class="lines">@@ -1136,20 +1124,11 @@
</span><span class="cx"> vm.heap.ascribeOwner(this, butterfly);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline JSValue JSObject::getPrototypeDirect() const
</del><ins>+inline JSValue JSObject::prototype() const
</ins><span class="cx"> {
</span><span class="cx"> return structure()->storedPrototype();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline JSValue JSObject::getPrototype(VM& vm, ExecState* exec)
-{
- auto getPrototypeMethod = methodTable(vm)->getPrototype;
- MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
- if (LIKELY(getPrototypeMethod == defaultGetPrototype))
- return getPrototypeDirect();
- return getPrototypeMethod(this, exec);
-}
-
</del><span class="cx"> // It is safe to call this method with a PropertyName that is actually an index,
</span><span class="cx"> // but if so will always return false (doesn't search index storage).
</span><span class="cx"> ALWAYS_INLINE bool JSObject::getOwnNonIndexPropertySlot(VM& vm, Structure& structure, PropertyName propertyName, PropertySlot& slot)
</span><span class="lines">@@ -1225,7 +1204,6 @@
</span><span class="cx"> // parsing the int again.
</span><span class="cx"> return object->getNonIndexPropertySlot(exec, propertyName, slot);
</span><span class="cx"> }
</span><del>- ASSERT(object->type() != ProxyObjectType);
</del><span class="cx"> Structure& structure = *structureIDTable.get(object->structureID());
</span><span class="cx"> if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
</span><span class="cx"> return true;
</span><span class="lines">@@ -1245,21 +1223,11 @@
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> auto& structureIDTable = vm.heap.structureIDTable();
</span><span class="cx"> JSObject* object = this;
</span><del>- MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
</del><span class="cx"> while (true) {
</span><span class="cx"> Structure& structure = *structureIDTable.get(object->structureID());
</span><span class="cx"> if (structure.classInfo()->methodTable.getOwnPropertySlotByIndex(object, exec, propertyName, slot))
</span><span class="cx"> return true;
</span><del>- if (UNLIKELY(vm.exception()))
- return false;
- JSValue prototype;
- if (LIKELY(structure.classInfo()->methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
- prototype = structure.storedPrototype();
- else {
- prototype = object->getPrototype(vm, exec);
- if (vm.exception())
- return false;
- }
</del><ins>+ JSValue prototype = structure.storedPrototype();
</ins><span class="cx"> if (!prototype.isObject())
</span><span class="cx"> return false;
</span><span class="cx"> object = asObject(prototype);
</span><span class="lines">@@ -1274,26 +1242,14 @@
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> auto& structureIDTable = vm.heap.structureIDTable();
</span><span class="cx"> JSObject* object = this;
</span><del>- MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
</del><span class="cx"> while (true) {
</span><span class="cx"> Structure& structure = *structureIDTable.get(object->structureID());
</span><span class="cx"> if (LIKELY(!TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()))) {
</span><span class="cx"> if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
</span><span class="cx"> return true;
</span><del>- } else {
- if (structure.classInfo()->methodTable.getOwnPropertySlot(object, exec, propertyName, slot))
- return true;
- if (UNLIKELY(vm.exception()))
- return false;
- }
- JSValue prototype;
- if (LIKELY(structure.classInfo()->methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
- prototype = structure.storedPrototype();
- else {
- prototype = object->getPrototype(vm, exec);
- if (vm.exception())
- return false;
- }
</del><ins>+ } else if (structure.classInfo()->methodTable.getOwnPropertySlot(object, exec, propertyName, slot))
+ return true;
+ JSValue prototype = structure.storedPrototype();
</ins><span class="cx"> if (!prototype.isObject())
</span><span class="cx"> return false;
</span><span class="cx"> object = asObject(prototype);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx"> if (obj->structure(vm)->hasReadOnlyOrGetterSetterPropertiesExcludingProto() || obj->type() == ProxyObjectType)
</span><span class="cx"> return false;
</span><span class="cx">
</span><del>- prototype = obj->getPrototypeDirect();
</del><ins>+ prototype = obj->prototype();
</ins><span class="cx"> if (prototype.isNull())
</span><span class="cx"> return true;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSProxycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSProxy.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSProxy.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSProxy.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT_ARG(globalObject, globalObject);
</span><span class="cx"> m_target.set(vm, this, globalObject);
</span><del>- setPrototypeDirect(vm, globalObject->getPrototypeDirect());
</del><ins>+ setPrototypeDirect(vm, globalObject->prototype());
</ins><span class="cx">
</span><span class="cx"> PrototypeMap& prototypeMap = vm.prototypeMap;
</span><span class="cx"> if (!prototypeMap.isPrototype(this))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx"> if (object->methodTable()->getConstructData(object, data) == ConstructType::None)
</span><span class="cx"> return JSValue::encode(throwTypeError(exec, "new.target passed to TypedArray is not a valid constructor."));
</span><span class="cx">
</span><del>- for (; !value.isNull(); value = jsCast<JSObject*>(value)->getPrototypeDirect()) {
</del><ins>+ for (; !value.isNull(); value = jsCast<JSObject*>(value)->prototype()) {
</ins><span class="cx"> if (jsDynamicCast<JSTypedArrayViewConstructor*>(value))
</span><span class="cx"> return JSValue::encode(throwTypeError(exec, "Unable to find TypedArray constructor that inherits from TypedArray."));
</span><span class="cx"> if (jsDynamicCast<JSGenericTypedArrayViewConstructor<JSInt8Array>*>(value))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -150,9 +150,8 @@
</span><span class="cx">
</span><span class="cx"> class ObjectConstructorGetPrototypeOfFunctor {
</span><span class="cx"> public:
</span><del>- ObjectConstructorGetPrototypeOfFunctor(ExecState* exec, JSObject* object)
- : m_exec(exec)
- , m_hasSkippedFirstFrame(false)
</del><ins>+ ObjectConstructorGetPrototypeOfFunctor(JSObject* object)
+ : m_hasSkippedFirstFrame(false)
</ins><span class="cx"> , m_object(object)
</span><span class="cx"> , m_result(jsUndefined())
</span><span class="cx"> {
</span><span class="lines">@@ -168,12 +167,11 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (m_object->allowsAccessFrom(visitor->callFrame()))
</span><del>- m_result = m_object->getPrototype(m_exec->vm(), m_exec);
</del><ins>+ m_result = m_object->prototype();
</ins><span class="cx"> return StackVisitor::Done;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- ExecState* m_exec;
</del><span class="cx"> bool m_hasSkippedFirstFrame;
</span><span class="cx"> JSObject* m_object;
</span><span class="cx"> JSValue m_result;
</span><span class="lines">@@ -181,10 +179,7 @@
</span><span class="cx">
</span><span class="cx"> JSValue objectConstructorGetPrototypeOf(ExecState* exec, JSObject* object)
</span><span class="cx"> {
</span><del>- ObjectConstructorGetPrototypeOfFunctor functor(exec, object);
- // This can throw but it's just unneeded extra work to check for it. The return
- // value from this function is only used as the return value from a host call.
- // Therefore, the return value is only used if there wasn't an exception.
</del><ins>+ ObjectConstructorGetPrototypeOfFunctor functor(object);
</ins><span class="cx"> exec->iterate(functor);
</span><span class="cx"> return functor.result();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -101,19 +101,14 @@
</span><span class="cx"> if (!exec->argument(0).isObject())
</span><span class="cx"> return JSValue::encode(jsBoolean(false));
</span><span class="cx">
</span><del>- VM& vm = exec->vm();
- JSValue v = asObject(exec->argument(0))->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
- return JSValue::encode(JSValue());
</del><ins>+ JSValue v = asObject(exec->argument(0))->prototype();
</ins><span class="cx">
</span><span class="cx"> while (true) {
</span><span class="cx"> if (!v.isObject())
</span><span class="cx"> return JSValue::encode(jsBoolean(false));
</span><span class="cx"> if (v == thisObj)
</span><span class="cx"> return JSValue::encode(jsBoolean(true));
</span><del>- v = asObject(v)->getPrototype(vm, exec);
- if (UNLIKELY(vm.exception()))
- return JSValue::encode(JSValue());
</del><ins>+ v = asObject(v)->prototype();
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProxyObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -90,10 +90,11 @@
</span><span class="cx"> // FIXME: make it so that custom getters take both the |this| value and the slotBase (property holder).
</span><span class="cx"> // https://bugs.webkit.org/show_bug.cgi?id=154320
</span><span class="cx"> while (true) {
</span><del>- if (LIKELY(proxyObjectAsObject->type() == ProxyObjectType))
</del><ins>+ if (LIKELY(proxyObjectAsObject->inherits(ProxyObject::info())))
</ins><span class="cx"> break;
</span><span class="cx">
</span><del>- JSValue prototype = proxyObjectAsObject->getPrototypeDirect();
</del><ins>+ Structure& structure = *vm.heap.structureIDTable().get(proxyObjectAsObject->structureID());
+ JSValue prototype = structure.storedPrototype();
</ins><span class="cx"> RELEASE_ASSERT(prototype.isObject());
</span><span class="cx"> proxyObjectAsObject = asObject(prototype);
</span><span class="cx"> }
</span><span class="lines">@@ -1005,9 +1006,7 @@
</span><span class="cx"> if (targetIsExtensible)
</span><span class="cx"> return true;
</span><span class="cx">
</span><del>- JSValue targetPrototype = target->getPrototype(vm, exec);
- if (vm.exception())
- return false;
</del><ins>+ JSValue targetPrototype = target->prototype();
</ins><span class="cx"> if (!sameValue(exec, prototype, targetPrototype)) {
</span><span class="cx"> throwVMTypeError(exec, ASCIILiteral("Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false."));
</span><span class="cx"> return false;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureInlines.h (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureInlines.h 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/runtime/StructureInlines.h 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -210,7 +210,7 @@
</span><span class="cx"> if (asObject(prototype)->structure() != cachedStructure->get())
</span><span class="cx"> return false;
</span><span class="cx"> ++cachedStructure;
</span><del>- prototype = asObject(prototype)->getPrototypeDirect();
</del><ins>+ prototype = asObject(prototype)->prototype();
</ins><span class="cx"> }
</span><span class="cx"> return prototype.isNull() && !*cachedStructure;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressproxyhaspropertyjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js (197645 => 197646)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js 2016-03-06 23:05:45 UTC (rev 197645)
+++ trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js 2016-03-06 23:12:08 UTC (rev 197646)
</span><span class="lines">@@ -367,79 +367,3 @@
</span><span class="cx"> assert(threw);
</span><span class="cx"> }
</span><span class="cx"> }
</span><del>-
-{
- let e1 = null;
- let e2 = null;
- let t1 = {};
- let called1 = false;
- let h1 = {
- has: function(theTarget, propName) {
- called1 = true;
- e1 = new Error;
- throw e1;
- return false;
- }
- };
- let p1 = new Proxy(t1, h1);
-
- let t2 = {};
- t2.__proto__ = p1;
- let h2 = {
- has: function(theTarget, propName) {
- e2 = new Error;
- throw e2;
- return false;
- }
- };
- let p2 = new Proxy(t2, h2);
- for (let i = 0; i < 500; i++) {
- let threw = false;
- try {
- 10 in p2;
- } catch(e) {
- assert(e === e2);
- threw = true;
- }
- assert(threw);
- assert(!called1);
- }
-}
-
-{
- let e1 = null;
- let e2 = null;
- let t1 = {};
- let called1 = false;
- let h1 = {
- has: function(theTarget, propName) {
- called1 = true;
- e1 = new Error;
- throw e1;
- return false;
- }
- };
- let p1 = new Proxy(t1, h1);
-
- let t2 = {};
- t2.__proto__ = p1;
- let h2 = {
- has: function(theTarget, propName) {
- e2 = new Error;
- throw e2;
- return false;
- }
- };
- let p2 = new Proxy(t2, h2);
- for (let i = 0; i < 500; i++) {
- let threw = false;
- try {
- "foo" in p2;
- } catch(e) {
- assert(e === e2);
- threw = true;
- }
- assert(threw);
- assert(!called1);
- }
-}
</del></span></pre>
</div>
</div>
</body>
</html>