Fixes operationPutByIdOptimizes such that they check that the put didn't
authormmirman@apple.com <mmirman@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 14 Jan 2015 21:00:52 +0000 (21:00 +0000)
committermmirman@apple.com <mmirman@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 14 Jan 2015 21:00:52 +0000 (21:00 +0000)
commit40f5720e2dbf5282935233f994bb42936cd04fcd
treee3917ceab66368deaac9d6f0c24c29352fb118e0
parent04f61d08dc28c5d68aabc1e56c294c1c2d6dd52e
Fixes operationPutByIdOptimizes such that they check that the put didn't
change the structure of the object who's property access is being
cached.  Also removes uses of the new base value from the cache generation code.
https://bugs.webkit.org/show_bug.cgi?id=139500

Reviewed by Filip Pizlo.

* jit/JITOperations.cpp:
(JSC::operationPutByIdStrictOptimize): saved the structure before the put.
(JSC::operationPutByIdNonStrictOptimize): ditto.
(JSC::operationPutByIdDirectStrictOptimize): ditto.
(JSC::operationPutByIdDirectNonStrictOptimize): ditto.
* jit/Repatch.cpp:
(JSC::generateByIdStub):
(JSC::tryCacheGetByID):
(JSC::tryBuildGetByIDList):
(JSC::emitPutReplaceStub):
(JSC::emitPutTransitionStubAndGetOldStructure): Added.
(JSC::tryCachePutByID):
(JSC::repatchPutByID):
(JSC::tryBuildPutByIdList):
(JSC::tryRepatchIn):
(JSC::emitPutTransitionStub): Deleted.
* jit/Repatch.h:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/JSPropertyNameEnumerator.h:
(JSC::genericPropertyNameEnumerator):
* runtime/Operations.h:
(JSC::normalizePrototypeChainForChainAccess): restructured to not use the base value.
(JSC::normalizePrototypeChain): restructured to not use the base value.
* tests/mozilla/mozilla-tests.yaml:
* tests/stress/proto-setter.js: Added.
* tests/stress/put-by-id-build-list-order-recurse.js: Added.
Added test that fails without this patch.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@178441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/jit/JITOperations.cpp
Source/JavaScriptCore/jit/Repatch.cpp
Source/JavaScriptCore/jit/Repatch.h
Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h
Source/JavaScriptCore/runtime/Operations.h
Source/JavaScriptCore/tests/mozilla/mozilla-tests.yaml
Source/JavaScriptCore/tests/stress/proto-setter.js [new file with mode: 0644]
Source/JavaScriptCore/tests/stress/put-by-id-build-list-order-recurse.js [new file with mode: 0644]