Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (211109 => 211110)
--- trunk/Source/_javascript_Core/ChangeLog 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-01-24 21:54:59 UTC (rev 211110)
@@ -1,3 +1,32 @@
+2017-01-24 Michael Saboff <[email protected]>
+
+ JSArray::tryCreateUninitialized should be called JSArray::tryCreateForInitializationPrivate
+ https://bugs.webkit.org/show_bug.cgi?id=167334
+
+ Rubber-stamped by Filip Pizlo.
+
+ * dfg/DFGOperations.cpp:
+ * ftl/FTLOperations.cpp:
+ (JSC::FTL::operationMaterializeObjectInOSR):
+ * runtime/ArrayPrototype.cpp:
+ (JSC::arrayProtoFuncSplice):
+ (JSC::arrayProtoPrivateFuncConcatMemcpy):
+ * runtime/CommonSlowPaths.cpp:
+ (JSC::SLOW_PATH_DECL):
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::tryCreateForInitializationPrivate):
+ (JSC::JSArray::fastSlice):
+ (JSC::JSArray::tryCreateUninitialized): Deleted.
+ * runtime/JSArray.h:
+ (JSC::JSArray::tryCreateForInitializationPrivate):
+ (JSC::constructArray):
+ (JSC::constructArrayNegativeIndexed):
+ (JSC::JSArray::tryCreateUninitialized): Deleted.
+ * runtime/RegExpMatchesArray.cpp:
+ (JSC::createEmptyRegExpMatchesArray):
+ * runtime/RegExpMatchesArray.h:
+ (JSC::createRegExpMatchesArray):
+
2017-01-23 Michael Saboff <[email protected]>
InferredTypeTable entry manipulation is not TOCTOU race safe
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (211109 => 211110)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2017-01-24 21:54:59 UTC (rev 211110)
@@ -1956,7 +1956,7 @@
JSGlobalObject* globalObject = exec->lexicalGlobalObject();
Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
- JSArray* result = JSArray::tryCreateUninitialized(vm, structure, length);
+ JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, structure, length);
RETURN_IF_EXCEPTION(scope, nullptr);
unsigned index = 0;
Modified: trunk/Source/_javascript_Core/ftl/FTLOperations.cpp (211109 => 211110)
--- trunk/Source/_javascript_Core/ftl/FTLOperations.cpp 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/ftl/FTLOperations.cpp 2017-01-24 21:54:59 UTC (rev 211110)
@@ -355,7 +355,7 @@
Structure* structure = globalObject->restParameterStructure();
ASSERT(argumentCount > 0);
unsigned arraySize = (argumentCount - 1) > numberOfArgumentsToSkip ? argumentCount - 1 - numberOfArgumentsToSkip : 0;
- JSArray* array = JSArray::tryCreateUninitialized(vm, structure, arraySize);
+ JSArray* array = JSArray::tryCreateForInitializationPrivate(vm, structure, arraySize);
RELEASE_ASSERT(array);
for (unsigned i = materialization->properties().size(); i--;) {
@@ -444,7 +444,7 @@
}
}
- JSArray* result = JSArray::tryCreateUninitialized(vm, structure, arraySize);
+ JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, structure, arraySize);
RELEASE_ASSERT(result);
#if !ASSERT_DISABLED
Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp (211109 => 211110)
--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2017-01-24 21:54:59 UTC (rev 211110)
@@ -1041,7 +1041,7 @@
RETURN_IF_EXCEPTION(scope, encodedJSValue());
}
} else {
- result = JSArray::tryCreateUninitialized(vm, exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), actualDeleteCount);
+ result = JSArray::tryCreateForInitializationPrivate(vm, exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), actualDeleteCount);
if (!result)
return JSValue::encode(throwOutOfMemoryError(exec, scope));
@@ -1283,7 +1283,7 @@
}
Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
- JSArray* result = JSArray::tryCreateUninitialized(vm, resultStructure, firstArraySize + secondArraySize);
+ JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, resultStructure, firstArraySize + secondArraySize);
if (!result)
return JSValue::encode(throwOutOfMemoryError(exec, scope));
Modified: trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp (211109 => 211110)
--- trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp 2017-01-24 21:54:59 UTC (rev 211110)
@@ -1005,7 +1005,7 @@
JSGlobalObject* globalObject = exec->lexicalGlobalObject();
Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
- JSArray* result = JSArray::tryCreateUninitialized(vm, structure, arraySize);
+ JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, structure, arraySize);
CHECK_EXCEPTION();
unsigned index = 0;
Modified: trunk/Source/_javascript_Core/runtime/JSArray.cpp (211109 => 211110)
--- trunk/Source/_javascript_Core/runtime/JSArray.cpp 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/runtime/JSArray.cpp 2017-01-24 21:54:59 UTC (rev 211110)
@@ -58,7 +58,7 @@
return butterfly;
}
-JSArray* JSArray::tryCreateUninitialized(VM& vm, GCDeferralContext* deferralContext, Structure* structure, unsigned initialLength)
+JSArray* JSArray::tryCreateForInitializationPrivate(VM& vm, GCDeferralContext* deferralContext, Structure* structure, unsigned initialLength)
{
if (initialLength > MAX_STORAGE_VECTOR_LENGTH)
return 0;
@@ -846,7 +846,7 @@
return nullptr;
Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(arrayType);
- JSArray* resultArray = JSArray::tryCreateUninitialized(vm, resultStructure, count);
+ JSArray* resultArray = JSArray::tryCreateForInitializationPrivate(vm, resultStructure, count);
if (!resultArray)
return nullptr;
Modified: trunk/Source/_javascript_Core/runtime/JSArray.h (211109 => 211110)
--- trunk/Source/_javascript_Core/runtime/JSArray.h 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/runtime/JSArray.h 2017-01-24 21:54:59 UTC (rev 211110)
@@ -56,7 +56,7 @@
static JSArray* create(VM&, Structure*, unsigned initialLength = 0);
static JSArray* createWithButterfly(VM&, GCDeferralContext*, Structure*, Butterfly*);
- // tryCreateUninitialized is used for fast construction of arrays whose size and
+ // tryCreateForInitializationPrivate is used for fast construction of arrays whose size and
// contents are known at time of creation. This should be considered a private API.
// Clients of this interface must:
// - null-check the result (indicating out of memory, or otherwise unable to allocate vector).
@@ -64,10 +64,10 @@
// - Provide a valid GCDefferalContext* if they might garbage collect when initializing properties,
// otherwise the caller can provide a null GCDefferalContext*.
//
- JS_EXPORT_PRIVATE static JSArray* tryCreateUninitialized(VM&, GCDeferralContext*, Structure*, unsigned initialLength);
- static JSArray* tryCreateUninitialized(VM& vm, Structure* structure, unsigned initialLength)
+ JS_EXPORT_PRIVATE static JSArray* tryCreateForInitializationPrivate(VM&, GCDeferralContext*, Structure*, unsigned initialLength);
+ static JSArray* tryCreateForInitializationPrivate(VM& vm, Structure* structure, unsigned initialLength)
{
- return tryCreateUninitialized(vm, nullptr, structure, initialLength);
+ return tryCreateForInitializationPrivate(vm, nullptr, structure, initialLength);
}
JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool throwException);
@@ -295,7 +295,7 @@
{
VM& vm = exec->vm();
unsigned length = values.size();
- JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+ JSArray* array = JSArray::tryCreateForInitializationPrivate(vm, arrayStructure, length);
// FIXME: we should probably throw an out of memory error here, but
// when making this change we should check that all clients of this
@@ -310,7 +310,7 @@
inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
{
VM& vm = exec->vm();
- JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+ JSArray* array = JSArray::tryCreateForInitializationPrivate(vm, arrayStructure, length);
// FIXME: we should probably throw an out of memory error here, but
// when making this change we should check that all clients of this
@@ -325,7 +325,7 @@
inline JSArray* constructArrayNegativeIndexed(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
{
VM& vm = exec->vm();
- JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+ JSArray* array = JSArray::tryCreateForInitializationPrivate(vm, arrayStructure, length);
// FIXME: we should probably throw an out of memory error here, but
// when making this change we should check that all clients of this
Modified: trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.cpp (211109 => 211110)
--- trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.cpp 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.cpp 2017-01-24 21:54:59 UTC (rev 211110)
@@ -39,7 +39,7 @@
GCDeferralContext deferralContext(vm.heap);
if (UNLIKELY(globalObject->isHavingABadTime())) {
- array = JSArray::tryCreateUninitialized(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), regExp->numSubpatterns() + 1);
+ array = JSArray::tryCreateForInitializationPrivate(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), regExp->numSubpatterns() + 1);
array->initializeIndexWithoutBarrier(0, jsEmptyString(&vm));
Modified: trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.h (211109 => 211110)
--- trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.h 2017-01-24 21:45:13 UTC (rev 211109)
+++ trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.h 2017-01-24 21:54:59 UTC (rev 211110)
@@ -80,7 +80,7 @@
GCDeferralContext deferralContext(vm.heap);
if (UNLIKELY(globalObject->isHavingABadTime())) {
- array = JSArray::tryCreateUninitialized(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), numSubpatterns + 1);
+ array = JSArray::tryCreateForInitializationPrivate(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), numSubpatterns + 1);
setProperties();
