Title: [248241] releases/WebKitGTK/webkit-2.24/Source/WebCore
- Revision
- 248241
- Author
- [email protected]
- Date
- 2019-08-03 20:23:34 -0700 (Sat, 03 Aug 2019)
Log Message
Merge r246801 - Add didBecomePrototype() calls to global context prototypes
https://bugs.webkit.org/show_bug.cgi?id=199202
Reviewed by Mark Lam.
This fixes some crashes related to asserting that all prototypes
have been marked as such in JSC from
https://trac.webkit.org/changeset/246801. It's ok to call
didBecomePrototype here as we setting up the world state right now
so we won't be having a bad time.
We don't automatically call didBecomePrototype() for
setPrototypeWithoutTransition because existing objects may already
have this structure so it seems more reasonable to be explicit
there.
* bindings/js/JSWindowProxy.cpp:
(WebCore::JSWindowProxy::setWindow):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::initScript):
* worklets/WorkletScriptController.cpp:
(WebCore::WorkletScriptController::initScriptWithSubclass):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog (248240 => 248241)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-08-04 03:23:31 UTC (rev 248240)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog 2019-08-04 03:23:34 UTC (rev 248241)
@@ -1,3 +1,28 @@
+2019-06-25 Keith Miller <[email protected]>
+
+ Add didBecomePrototype() calls to global context prototypes
+ https://bugs.webkit.org/show_bug.cgi?id=199202
+
+ Reviewed by Mark Lam.
+
+ This fixes some crashes related to asserting that all prototypes
+ have been marked as such in JSC from
+ https://trac.webkit.org/changeset/246801. It's ok to call
+ didBecomePrototype here as we setting up the world state right now
+ so we won't be having a bad time.
+
+ We don't automatically call didBecomePrototype() for
+ setPrototypeWithoutTransition because existing objects may already
+ have this structure so it seems more reasonable to be explicit
+ there.
+
+ * bindings/js/JSWindowProxy.cpp:
+ (WebCore::JSWindowProxy::setWindow):
+ * bindings/js/WorkerScriptController.cpp:
+ (WebCore::WorkerScriptController::initScript):
+ * worklets/WorkletScriptController.cpp:
+ (WebCore::WorkletScriptController::initScriptWithSubclass):
+
2019-05-20 Chris Dumez <[email protected]>
Fix security check in ScriptController::canAccessFromCurrentOrigin()
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/bindings/js/JSWindowProxy.cpp (248240 => 248241)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/bindings/js/JSWindowProxy.cpp 2019-08-04 03:23:31 UTC (rev 248240)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/bindings/js/JSWindowProxy.cpp 2019-08-04 03:23:34 UTC (rev 248241)
@@ -111,6 +111,7 @@
auto& propertiesStructure = *JSDOMWindowProperties::createStructure(vm, window, JSEventTarget::prototype(vm, *window));
auto& properties = *JSDOMWindowProperties::create(&propertiesStructure, *window);
+ properties.didBecomePrototype();
prototype->structure(vm)->setPrototypeWithoutTransition(vm, &properties);
setWindow(vm, *window);
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/bindings/js/WorkerScriptController.cpp (248240 => 248241)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/bindings/js/WorkerScriptController.cpp 2019-08-04 03:23:31 UTC (rev 248240)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/bindings/js/WorkerScriptController.cpp 2019-08-04 03:23:34 UTC (rev 248241)
@@ -90,7 +90,9 @@
ASSERT(structure->globalObject() == m_workerGlobalScopeWrapper);
ASSERT(m_workerGlobalScopeWrapper->structure(*m_vm)->globalObject() == m_workerGlobalScopeWrapper);
dedicatedContextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
- dedicatedContextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get()));
+ auto* workerGlobalScopePrototype = JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get());
+ workerGlobalScopePrototype->didBecomePrototype();
+ dedicatedContextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, workerGlobalScopePrototype);
proxy->setTarget(*m_vm, m_workerGlobalScopeWrapper.get());
proxy->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
@@ -107,7 +109,9 @@
ASSERT(structure->globalObject() == m_workerGlobalScopeWrapper);
ASSERT(m_workerGlobalScopeWrapper->structure()->globalObject() == m_workerGlobalScopeWrapper);
contextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
- contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get()));
+ auto* workerGlobalScopePrototype = JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get());
+ workerGlobalScopePrototype->didBecomePrototype();
+ contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, workerGlobalScopePrototype);
proxy->setTarget(*m_vm, m_workerGlobalScopeWrapper.get());
proxy->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/worklets/WorkletScriptController.cpp (248240 => 248241)
--- releases/WebKitGTK/webkit-2.24/Source/WebCore/worklets/WorkletScriptController.cpp 2019-08-04 03:23:31 UTC (rev 248240)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/worklets/WorkletScriptController.cpp 2019-08-04 03:23:34 UTC (rev 248241)
@@ -126,7 +126,9 @@
ASSERT(structure->globalObject() == m_workletGlobalScopeWrapper);
ASSERT(m_workletGlobalScopeWrapper->structure(*m_vm)->globalObject() == m_workletGlobalScopeWrapper);
contextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workletGlobalScopeWrapper.get());
- contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSGlobalScope::prototype(*m_vm, *m_workletGlobalScopeWrapper.get()));
+ auto* globalScopePrototype = JSGlobalScope::prototype(*m_vm, *m_workletGlobalScopeWrapper.get());
+ globalScopePrototype->didBecomePrototype();
+ contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, globalScopePrototype);
proxy->setTarget(*m_vm, m_workletGlobalScopeWrapper.get());
proxy->structure(*m_vm)->setGlobalObject(*m_vm, m_workletGlobalScopeWrapper.get());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
