[webkit-changes] [264895] trunk/Source

Sat, 25 Jul 2020 22:12:07 -0700

Title: [264895] trunk/Source
Revision
264895
Author
[email protected]
Date
2020-07-25 22:11:06 -0700 (Sat, 25 Jul 2020)

Log Message

pluginElementCustomGetOwnPropertySlot() should support VMInquiry requests.
https://bugs.webkit.org/show_bug.cgi?id=214555
<rdar://problem/65855400>

Reviewed by Yusuke Suzuki.

Source/_javascript_Core:

1. Add handling for VMInquiry failure in JSObject::getPropertySlot() and
   JSObject::getNonIndexPropertySlot().  Basically, if the query isTaintedByOpaqueObject,
   then we should treat the false result as a failed VMInquiry.

2. Fix JSModuleNamespaceObject::getOwnPropertySlotCommon() and
   ProxyObject::getOwnPropertySlotCommon() to initialize the PropertySlot to a
   jsUndefined() value if we have a failed VMInquiry.  The client shouldn't
   be reading the value if the VMInquiry failed, but as a defensive action, we'll
   initialize the slot to effectively return an undefined value.

* runtime/JSModuleNamespaceObject.cpp:
(JSC::JSModuleNamespaceObject::getOwnPropertySlotCommon):
* runtime/JSObjectInlines.h:
(JSC::JSObject::getPropertySlot):
(JSC::JSObject::getNonIndexPropertySlot):
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::getOwnPropertySlotCommon):

Source/WebCore:

1. Add handling for VMInquiry failure in CodeGeneratorJS.

2. Fix pluginElementCustomGetOwnPropertySlot() to setIsTaintedByOpaqueObject().

3. Fix pluginElementCustomGetOwnPropertySlot() handle a VMInquiry failure case
   and if so, to initialize the PropertySlot to a jsUndefined() value.  The client
   shouldn't be reading the value if the VMInquiry failed, but as a defensive
   action, we'll initialize the slot to effectively return an undefined value.

* bindings/js/JSPluginElementFunctions.cpp:
(WebCore::pluginElementCustomGetOwnPropertySlot):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlot):
(GenerateGetOwnPropertySlotByIndex):
* bindings/scripts/test/JS/JSTestPluginInterface.cpp:
(WebCore::JSTestPluginInterface::getOwnPropertySlot):
(WebCore::JSTestPluginInterface::getOwnPropertySlotByIndex):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (264894 => 264895)


--- trunk/Source/_javascript_Core/ChangeLog	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/_javascript_Core/ChangeLog	2020-07-26 05:11:06 UTC (rev 264895)
@@ -1,3 +1,29 @@
+2020-07-24  Mark Lam  <[email protected]>
+
+        pluginElementCustomGetOwnPropertySlot() should support VMInquiry requests.
+        https://bugs.webkit.org/show_bug.cgi?id=214555
+        <rdar://problem/65855400>
+
+        Reviewed by Yusuke Suzuki.
+
+        1. Add handling for VMInquiry failure in JSObject::getPropertySlot() and
+           JSObject::getNonIndexPropertySlot().  Basically, if the query isTaintedByOpaqueObject,
+           then we should treat the false result as a failed VMInquiry.
+
+        2. Fix JSModuleNamespaceObject::getOwnPropertySlotCommon() and
+           ProxyObject::getOwnPropertySlotCommon() to initialize the PropertySlot to a
+           jsUndefined() value if we have a failed VMInquiry.  The client shouldn't
+           be reading the value if the VMInquiry failed, but as a defensive action, we'll
+           initialize the slot to effectively return an undefined value.
+
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlotCommon):
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+
 2020-07-24  Dean Jackson  <[email protected]>
 
         _javascript_Core Xcode project has some errors

Modified: trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp (264894 => 264895)


--- trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp	2020-07-26 05:11:06 UTC (rev 264895)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -157,6 +157,7 @@
     }
 
     case PropertySlot::InternalMethodType::VMInquiry:
+        slot.setValue(this, static_cast<unsigned>(JSC::PropertyAttribute::None), jsUndefined());
         return false;
     }

Modified: trunk/Source/_javascript_Core/runtime/JSObjectInlines.h (264894 => 264895)


--- trunk/Source/_javascript_Core/runtime/JSObjectInlines.h	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/_javascript_Core/runtime/JSObjectInlines.h	2020-07-26 05:11:06 UTC (rev 264895)
@@ -133,6 +133,8 @@
         RETURN_IF_EXCEPTION(scope, false);
         if (hasSlot)
             return true;
+        if (UNLIKELY(slot.isVMInquiry() && slot.isTaintedByOpaqueObject()))
+            return false;
         if (object->type() == ProxyObjectType && slot.internalMethodType() == PropertySlot::InternalMethodType::HasProperty)
             return false;
         JSValue prototype;
@@ -174,6 +176,8 @@
             RETURN_IF_EXCEPTION(scope, false);
             if (hasSlot)
                 return true;
+            if (UNLIKELY(slot.isVMInquiry() && slot.isTaintedByOpaqueObject()))
+                return false;
             if (object->type() == ProxyObjectType && slot.internalMethodType() == PropertySlot::InternalMethodType::HasProperty)
                 return false;
         }

Modified: trunk/Source/_javascript_Core/runtime/ProxyObject.cpp (264894 => 264895)


--- trunk/Source/_javascript_Core/runtime/ProxyObject.cpp	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/_javascript_Core/runtime/ProxyObject.cpp	2020-07-26 05:11:06 UTC (rev 264895)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2019 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2016-2020 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -332,8 +332,10 @@
     slot.disableCaching();
     slot.setIsTaintedByOpaqueObject();
 
-    if (slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry)
+    if (slot.isVMInquiry()) {
+        slot.setValue(this, static_cast<unsigned>(JSC::PropertyAttribute::None), jsUndefined());
         return false;
+    }
 
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);

Modified: trunk/Source/WebCore/ChangeLog (264894 => 264895)


--- trunk/Source/WebCore/ChangeLog	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/WebCore/ChangeLog	2020-07-26 05:11:06 UTC (rev 264895)
@@ -1,3 +1,29 @@
+2020-07-24  Mark Lam  <[email protected]>
+
+        pluginElementCustomGetOwnPropertySlot() should support VMInquiry requests.
+        https://bugs.webkit.org/show_bug.cgi?id=214555
+        <rdar://problem/65855400>
+
+        Reviewed by Yusuke Suzuki.
+
+        1. Add handling for VMInquiry failure in CodeGeneratorJS.
+
+        2. Fix pluginElementCustomGetOwnPropertySlot() to setIsTaintedByOpaqueObject().
+
+        3. Fix pluginElementCustomGetOwnPropertySlot() handle a VMInquiry failure case
+           and if so, to initialize the PropertySlot to a jsUndefined() value.  The client
+           shouldn't be reading the value if the VMInquiry failed, but as a defensive
+           action, we'll initialize the slot to effectively return an undefined value.
+
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginElementCustomGetOwnPropertySlot):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlot):
+        (GenerateGetOwnPropertySlotByIndex):
+        * bindings/scripts/test/JS/JSTestPluginInterface.cpp:
+        (WebCore::JSTestPluginInterface::getOwnPropertySlot):
+        (WebCore::JSTestPluginInterface::getOwnPropertySlotByIndex):
+
 2020-07-25  Wenson Hsieh  <[email protected]>
 
         [iOS] Crash under ValidationBubble::setAnchorRect when showing form validation UI in unparented view

Modified: trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp (264894 => 264895)


--- trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp	2020-07-26 05:11:06 UTC (rev 264895)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten ([email protected])
- *  Copyright (C) 2004-2019 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004-2020 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -111,6 +111,8 @@
 
 bool pluginElementCustomGetOwnPropertySlot(JSHTMLElement* element, JSGlobalObject* lexicalGlobalObject, PropertyName propertyName, PropertySlot& slot)
 {
+    slot.setIsTaintedByOpaqueObject();
+
     if (!element->globalObject()->world().isNormal()) {
         JSC::JSValue proto = element->getPrototypeDirect(lexicalGlobalObject->vm());
         if (proto.isObject() && JSC::jsCast<JSC::JSObject*>(asObject(proto))->hasProperty(lexicalGlobalObject, propertyName))
@@ -117,6 +119,11 @@
             return false;
     }
 
+    if (slot.isVMInquiry()) {
+        slot.setValue(element, static_cast<unsigned>(JSC::PropertyAttribute::None), jsUndefined());
+        return false; // Can't execute stuff below because they can call back into JS.
+    }
+
     JSObject* scriptObject = pluginScriptObject(lexicalGlobalObject, element);
     if (!scriptObject)
         return false;

Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (264894 => 264895)


--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2020-07-26 05:11:06 UTC (rev 264895)
@@ -706,6 +706,9 @@
         AddToImplIncludes("JSPluginElementFunctions.h");
         push(@$outputArray, "    if (pluginElementCustomGetOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot))\n");
         push(@$outputArray, "        return true;\n");
+        push(@$outputArray, "    ASSERT(slot.isTaintedByOpaqueObject());\n");
+        push(@$outputArray, "    if (slot.isVMInquiry())\n");
+        push(@$outputArray, "        return false;\n");
     }
 
     # 3. Return OrdinaryGetOwnProperty(O, P).
@@ -819,6 +822,9 @@
         AddToImplIncludes("JSPluginElementFunctions.h");
         push(@$outputArray, "    if (pluginElementCustomGetOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot))\n");
         push(@$outputArray, "        return true;\n");
+        push(@$outputArray, "    ASSERT(slot.isTaintedByOpaqueObject());\n");
+        push(@$outputArray, "    if (slot.isVMInquiry())\n");
+        push(@$outputArray, "        return false;\n");
     }
 
     # 3. Return OrdinaryGetOwnProperty(O, P).

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp (264894 => 264895)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp	2020-07-26 05:03:09 UTC (rev 264894)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp	2020-07-26 05:11:06 UTC (rev 264895)
@@ -156,6 +156,9 @@
     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
     if (pluginElementCustomGetOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot))
         return true;
+    ASSERT(slot.isTaintedByOpaqueObject());
+    if (slot.isVMInquiry())
+        return false;
     return JSObject::getOwnPropertySlot(object, lexicalGlobalObject, propertyName, slot);
 }
 
@@ -167,6 +170,9 @@
     auto propertyName = Identifier::from(vm, index);
     if (pluginElementCustomGetOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot))
         return true;
+    ASSERT(slot.isTaintedByOpaqueObject());
+    if (slot.isVMInquiry())
+        return false;
     return JSObject::getOwnPropertySlotByIndex(object, lexicalGlobalObject, index, slot);
 }
 

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to