Diff
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog (248239 => 248240)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-08-04 03:23:29 UTC (rev 248239)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-08-04 03:23:31 UTC (rev 248240)
@@ -1,3 +1,23 @@
+2019-06-25 Keith Miller <[email protected]>
+
+ Structure::create should call didBecomePrototype()
+ https://bugs.webkit.org/show_bug.cgi?id=196315
+
+ Reviewed by Filip Pizlo.
+
+ Structure::create should also assert that the indexing type makes sense
+ for the prototype being used.
+
+ * runtime/JSObject.h:
+ * runtime/Structure.cpp:
+ (JSC::Structure::isValidPrototype):
+ (JSC::Structure::changePrototypeTransition):
+ * runtime/Structure.h:
+ (JSC::Structure::create): Deleted.
+ * runtime/StructureInlines.h:
+ (JSC::Structure::create):
+ (JSC::Structure::setPrototypeWithoutTransition):
+
2019-07-15 Tadeu Zagallo <[email protected]>
Concurrent GC should not rely on current phase to determine if it's safe to steal conn
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/JSObject.h (248239 => 248240)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/JSObject.h 2019-08-04 03:23:29 UTC (rev 248239)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/JSObject.h 2019-08-04 03:23:31 UTC (rev 248240)
@@ -741,7 +741,7 @@
bool isSealed(VM& vm) { return structure(vm)->isSealed(vm); }
bool isFrozen(VM& vm) { return structure(vm)->isFrozen(vm); }
- bool anyObjectInChainMayInterceptIndexedAccesses(VM&) const;
+ JS_EXPORT_PRIVATE bool anyObjectInChainMayInterceptIndexedAccesses(VM&) const;
JS_EXPORT_PRIVATE bool prototypeChainMayInterceptStoreTo(VM&, PropertyName);
bool needsSlowPutIndexing(VM&) const;
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/Structure.cpp (248239 => 248240)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/Structure.cpp 2019-08-04 03:23:29 UTC (rev 248239)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/Structure.cpp 2019-08-04 03:23:31 UTC (rev 248240)
@@ -321,6 +321,11 @@
return result;
}
+bool Structure::isValidPrototype(JSValue prototype)
+{
+ return prototype.isNull() || (prototype.isObject() && prototype.getObject()->mayBePrototype());
+}
+
void Structure::findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*& structure, PropertyTable*& table)
{
ASSERT(structures.isEmpty());
@@ -544,7 +549,7 @@
Structure* Structure::changePrototypeTransition(VM& vm, Structure* structure, JSValue prototype, DeferredStructureTransitionWatchpointFire& deferred)
{
- ASSERT(prototype.isObject() || prototype.isNull());
+ ASSERT(isValidPrototype(prototype));
DeferGC deferGC(vm.heap);
Structure* transition = create(vm, structure, &deferred);
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/Structure.h (248239 => 248240)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/Structure.h 2019-08-04 03:23:29 UTC (rev 248239)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/Structure.h 2019-08-04 03:23:31 UTC (rev 248240)
@@ -138,11 +138,13 @@
return &vm.structureSpace;
}
+ JS_EXPORT_PRIVATE static bool isValidPrototype(JSValue);
+
protected:
void finishCreation(VM& vm)
{
Base::finishCreation(vm);
- ASSERT(m_prototype.get().isEmpty() || m_prototype.isObject() || m_prototype.isNull());
+ ASSERT(m_prototype.get().isEmpty() || isValidPrototype(m_prototype.get()));
}
void finishCreation(VM& vm, const Structure* previous)
@@ -786,16 +788,4 @@
uint32_t m_propertyHash;
};
-// We deliberately put Structure::create here in Structure.h instead of StructureInlines.h, because
-// it is used everywhere. This is so we don't have to hunt down all the places where we would need
-// to #include StructureInlines.h otherwise.
-inline Structure* Structure::create(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
-{
- ASSERT(vm.structureStructure);
- ASSERT(classInfo);
- Structure* structure = new (NotNull, allocateCell<Structure>(vm.heap)) Structure(vm, globalObject, prototype, typeInfo, classInfo, indexingType, inlineCapacity);
- structure->finishCreation(vm);
- return structure;
-}
-
} // namespace JSC
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/StructureInlines.h (248239 => 248240)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/StructureInlines.h 2019-08-04 03:23:29 UTC (rev 248239)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/StructureInlines.h 2019-08-04 03:23:31 UTC (rev 248240)
@@ -35,6 +35,20 @@
namespace JSC {
+inline Structure* Structure::create(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
+{
+ ASSERT(vm.structureStructure);
+ ASSERT(classInfo);
+ if (auto* object = prototype.getObject()) {
+ ASSERT(!object->anyObjectInChainMayInterceptIndexedAccesses(vm) || hasSlowPutArrayStorage(indexingType) || !hasIndexedProperties(indexingType));
+ object->didBecomePrototype();
+ }
+
+ Structure* structure = new (NotNull, allocateCell<Structure>(vm.heap)) Structure(vm, globalObject, prototype, typeInfo, classInfo, indexingType, inlineCapacity);
+ structure->finishCreation(vm);
+ return structure;
+}
+
inline Structure* Structure::createStructure(VM& vm)
{
ASSERT(!vm.structureStructure);
@@ -493,6 +507,7 @@
ALWAYS_INLINE void Structure::setPrototypeWithoutTransition(VM& vm, JSValue prototype)
{
+ ASSERT(isValidPrototype(prototype));
m_prototype.set(vm, this, prototype);
}
