Reviewers: Weiliang,
Message:
PTAL.
Description:
X87: Only dynamically perform access checks on the receiver if it's a
JSGlobalProxy.
port e9cdcb71743200e7dd18b0be62f764aa53729c63 (r26875)
original commit message:
Only dynamically perform access checks on the receiver if it's a
JSGlobalProxy.
Proxies up the chain are guaranteed to provide access if we had access to
the
receiver,
since otherwise we wouldn't have been able to compile the stub in the
first
place.
If the security check would change, the window navigates, changing the
map of
the JSGlobalProxy.
BUG=
Please review this at https://codereview.chromium.org/964813002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+12, -18 lines):
M src/ic/x87/handler-compiler-x87.cc
Index: src/ic/x87/handler-compiler-x87.cc
diff --git a/src/ic/x87/handler-compiler-x87.cc
b/src/ic/x87/handler-compiler-x87.cc
index
2eb10c3a3bce9bfc32e51dd755f9b8286d02cad9..f64e7d8f0d083aba5d7ceef18e7412c04e731f79
100644
--- a/src/ic/x87/handler-compiler-x87.cc
+++ b/src/ic/x87/handler-compiler-x87.cc
@@ -431,6 +431,17 @@ Register PropertyHandlerCompiler::CheckPrototypes(
if (receiver_map->IsJSGlobalObjectMap()) {
current = isolate()->global_object();
}
+
+ // Check access rights to the global object. This has to happen after
+ // the map check so that we know that the object is actually a global
+ // object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding code
+ // in LookupForRead().
+ if (receiver_map->IsJSGlobalProxyMap()) {
+ __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
+ }
+
Handle<JSObject> prototype = Handle<JSObject>::null();
Handle<Map> current_map = receiver_map;
Handle<Map> holder_map(holder()->map());
@@ -471,17 +482,7 @@ Register PropertyHandlerCompiler::CheckPrototypes(
__ j(not_equal, miss);
}
- // Check access rights to the global object. This has to happen
after
- // the map check so that we know that the object is actually a global
- // object.
- // This allows us to install generated handlers for accesses to the
- // global proxy (as opposed to using slow ICs). See corresponding
code
- // in LookupForRead().
- if (current_map->IsJSGlobalProxyMap()) {
- __ CheckAccessGlobalProxy(reg, map_reg, scratch2, miss);
- // Restore map_reg.
- __ mov(map_reg, FieldOperand(reg, HeapObject::kMapOffset));
- } else if (current_map->IsJSGlobalObjectMap()) {
+ if (current_map->IsJSGlobalObjectMap()) {
GenerateCheckPropertyCell(masm(),
Handle<JSGlobalObject>::cast(current),
name, scratch2, miss);
}
@@ -505,13 +506,6 @@ Register PropertyHandlerCompiler::CheckPrototypes(
__ j(not_equal, miss);
}
- // Perform security check for access to the global object.
- DCHECK(current_map->IsJSGlobalProxyMap() ||
- !current_map->is_access_check_needed());
- if (current_map->IsJSGlobalProxyMap()) {
- __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
- }
-
// Return the register containing the holder.
return reg;
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
