Title: [260434] trunk/Source/_javascript_Core
- Revision
- 260434
- Author
- [email protected]
- Date
- 2020-04-21 10:10:47 -0700 (Tue, 21 Apr 2020)
Log Message
Check Structure attributes in Object.assign exhaustively
https://bugs.webkit.org/show_bug.cgi?id=210782
<rdar://problem/62065853>
Reviewed by Mark Lam.
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorAssign):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (260433 => 260434)
--- trunk/Source/_javascript_Core/ChangeLog 2020-04-21 16:58:55 UTC (rev 260433)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-04-21 17:10:47 UTC (rev 260434)
@@ -1,3 +1,14 @@
+2020-04-20 Yusuke Suzuki <[email protected]>
+
+ Check Structure attributes in Object.assign exhaustively
+ https://bugs.webkit.org/show_bug.cgi?id=210782
+ <rdar://problem/62065853>
+
+ Reviewed by Mark Lam.
+
+ * runtime/ObjectConstructor.cpp:
+ (JSC::objectConstructorAssign):
+
2020-04-21 Adrian Perez de Castro <[email protected]>
Non-unified build fixes late February 2020 edition
Modified: trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp (260433 => 260434)
--- trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp 2020-04-21 16:58:55 UTC (rev 260433)
+++ trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp 2020-04-21 17:10:47 UTC (rev 260434)
@@ -320,6 +320,10 @@
return false;
if (structure->hasGetterSetterProperties())
return false;
+ if (structure->hasReadOnlyOrGetterSetterPropertiesExcludingProto())
+ return false;
+ if (structure->hasCustomGetterSetterProperties())
+ return false;
if (structure->isUncacheableDictionary())
return false;
// Cannot perform fast [[Put]] to |target| if the property names of the |source| contain "__proto__".
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
