ReplaceSubstring() is an O(n*m) algorithm (n being the length of the
string and m being the number of occurrences of aTarget) because we have
to move the remainder of the string, search it again and potentially
memmove most of it again as we find more matches. This patch rewrites
that function to make it O(n+m).
Note that we currently don't build TestStrings.cpp, so the test case in
this patch is not run automatically, but the test case has been verified
to pass separately by moving the test function into Gecko and calling it
during startup and stepping through it in the debugger.
Talos causes accessibility to be instantiated only in the content
process. That means PDocAccessibleConstructor messages can be recieved
by the parent when GetAccService() returns null. The easiest way of
dealing with this is moving DocManager::mRemoteDocuments from a member
of the acc service singleton to its own global. That means the parent
process can track accessible documents in child processes without
instantiating a11y in the parent process.
With this patch:
* SetPropertyHelper no longer calls lookupProperty hooks, which is nice
since there's no such thing in ES6.
* As SetPropertyHelper walks the prototype chain, as soon as it reaches a
non-native object, it calls that object's set hook, passing the original
receiver, and returns.
This means Proxy set traps will now be called per spec when triggered via
the prototype chain from a native object.
It also means that legacy scripted indirect proxies (Proxy.create) will
now sometimes have their set trap called when it wouldn't have been called
before. This seems to be confined to fuzztests in practice, since it only
matters when the proxy is used as the prototype of an ordinary object.
But it could cause trouble.
The same situation affects other proxies too: BaseProxyHandler::set() and
its overrides will all be called in new situations. It's inevitable though;
Reflect.set was going to enable all these situations anyway.
--HG--
extra : rebase_source : 01bb32b4950ea14922f135bf785aea7d298c8dfb
At this point, SetPropertyHelper has been factored into five parts:
SetPropertyByDefining
SetNonexistentProperty
SetDenseOrTypedArrayElement
SetExistingProperty
SetPropertyHelper
each with a comment on top and a reasonably clear responsibility. The longest is less than 100 lines, including comments.
--HG--
extra : rebase_source : 4d32ae23b5cdbaa357c205766894dfaa2184c755
As it stands, this code is relatively obscure, so the fact that it's amazingly busted is of little consequence. But once we implement ES6 assignment, this code will be fairly easy to trigger when assigning to any Proxy whose target is an Array.
--HG--
extra : rebase_source : f939b92b42f0470fb0309097fb82f46383a61b25
extra : source : 1ecbc62d82a38e6e36e6ede090d711f3b3ad13ba
This one is a little complicated. There is some code in SetExistingProperty that is supposed to determine whether or not we should shadow a property that wasn't found on the receiver. This code does not work correctly for array.length properties. (array.length is a data property, so of course it should be shadowed -- but it is non-shadowable() because hasSlot() is false.)
Having fixed that bug, the call to SetArrayLength is only necessary in the non-shadowing case. (In fact, it would be unnecessary altogether but for Parallel JS.) This in turn makes 'attrs' unnecessary, so delete that.
This is a behavior change (a bug fix) in the case of proxies, as the test illustrates.
--HG--
extra : rebase_source : c968a95baf41944ca82a16d40af51a1512ad0938
extra : source : f322eac33cfa1b54486d1d73f62658019774e373
