Diff
Modified: branches/safari-610-branch/JSTests/ChangeLog (267634 => 267635)
--- branches/safari-610-branch/JSTests/ChangeLog 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/JSTests/ChangeLog 2020-09-26 21:08:52 UTC (rev 267635)
@@ -1,5 +1,70 @@
2020-09-25 Alan Coon <[email protected]>
+ Cherry-pick r267113. rdar://problem/69586723
+
+ CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
+ https://bugs.webkit.org/show_bug.cgi?id=216575
+ <rdar://problem/68286930>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added.
+ (foo):
+
+ Source/_javascript_Core:
+
+ The CustomFunctionEquivalence PropertyCondition would only return false to
+ isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
+ property table was reified or if the static property table did not contain the
+ property. However, this missed the obvious case of where we store to this
+ property in normal object storage without reifying the static property table.
+ The fix here is simple: we first check if the Structure's property table
+ has this property, and if so, return false.
+
+ This patch also renames CustomFunctionEquivalence to HasStaticProperty to
+ better capture what we're doing.
+
+ * bytecode/ObjectPropertyCondition.h:
+ (JSC::ObjectPropertyCondition::hasStaticProperty):
+ (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
+ * bytecode/ObjectPropertyConditionSet.cpp:
+ (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const):
+ (JSC::ObjectPropertyConditionSet::slotBaseCondition const):
+ (JSC::generateConditionsForPrototypePropertyHitCustom):
+ * bytecode/PropertyCondition.cpp:
+ (JSC::PropertyCondition::dumpInContext const):
+ (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
+ (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
+ (JSC::PropertyCondition::isStillValid const):
+ (JSC::PropertyCondition::isWatchableWhenValid const):
+ (WTF::printInternal):
+ * bytecode/PropertyCondition.h:
+ (JSC::PropertyCondition::hasStaticProperty):
+ (JSC::PropertyCondition::hash const):
+ (JSC::PropertyCondition::operator== const):
+ (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
+ * tools/JSDollarVM.cpp:
+ (JSC::functionCreateStaticCustomValue):
+ (JSC::JSDollarVM::finishCreation):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267113 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-09-15 Saam Barati <[email protected]>
+
+ CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
+ https://bugs.webkit.org/show_bug.cgi?id=216575
+ <rdar://problem/68286930>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added.
+ (foo):
+
+2020-09-25 Alan Coon <[email protected]>
+
Cherry-pick r266813. rdar://problem/69582551
OutOfBoundsSaneChain operations should use their own heap locations
Added: branches/safari-610-branch/JSTests/stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js (0 => 267635)
--- branches/safari-610-branch/JSTests/stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js (rev 0)
+++ branches/safari-610-branch/JSTests/stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js 2020-09-26 21:08:52 UTC (rev 267635)
@@ -0,0 +1,18 @@
+let o = {};
+let p = $vm.createStaticCustomValue();
+o.__proto__ = p;
+
+function foo(o) {
+ return o.testStaticValue;
+}
+noInline(foo);
+
+foo(o);
+foo(o);
+foo(o);
+foo(o);
+p.testStaticValue = 42;
+
+for (let i = 0; i < 100; ++i) {
+ foo(o);
+}
Modified: branches/safari-610-branch/Source/_javascript_Core/ChangeLog (267634 => 267635)
--- branches/safari-610-branch/Source/_javascript_Core/ChangeLog 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/Source/_javascript_Core/ChangeLog 2020-09-26 21:08:52 UTC (rev 267635)
@@ -1,5 +1,101 @@
2020-09-25 Alan Coon <[email protected]>
+ Cherry-pick r267113. rdar://problem/69586723
+
+ CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
+ https://bugs.webkit.org/show_bug.cgi?id=216575
+ <rdar://problem/68286930>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added.
+ (foo):
+
+ Source/_javascript_Core:
+
+ The CustomFunctionEquivalence PropertyCondition would only return false to
+ isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
+ property table was reified or if the static property table did not contain the
+ property. However, this missed the obvious case of where we store to this
+ property in normal object storage without reifying the static property table.
+ The fix here is simple: we first check if the Structure's property table
+ has this property, and if so, return false.
+
+ This patch also renames CustomFunctionEquivalence to HasStaticProperty to
+ better capture what we're doing.
+
+ * bytecode/ObjectPropertyCondition.h:
+ (JSC::ObjectPropertyCondition::hasStaticProperty):
+ (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
+ * bytecode/ObjectPropertyConditionSet.cpp:
+ (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const):
+ (JSC::ObjectPropertyConditionSet::slotBaseCondition const):
+ (JSC::generateConditionsForPrototypePropertyHitCustom):
+ * bytecode/PropertyCondition.cpp:
+ (JSC::PropertyCondition::dumpInContext const):
+ (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
+ (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
+ (JSC::PropertyCondition::isStillValid const):
+ (JSC::PropertyCondition::isWatchableWhenValid const):
+ (WTF::printInternal):
+ * bytecode/PropertyCondition.h:
+ (JSC::PropertyCondition::hasStaticProperty):
+ (JSC::PropertyCondition::hash const):
+ (JSC::PropertyCondition::operator== const):
+ (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
+ * tools/JSDollarVM.cpp:
+ (JSC::functionCreateStaticCustomValue):
+ (JSC::JSDollarVM::finishCreation):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267113 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-09-15 Saam Barati <[email protected]>
+
+ CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
+ https://bugs.webkit.org/show_bug.cgi?id=216575
+ <rdar://problem/68286930>
+
+ Reviewed by Yusuke Suzuki.
+
+ The CustomFunctionEquivalence PropertyCondition would only return false to
+ isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
+ property table was reified or if the static property table did not contain the
+ property. However, this missed the obvious case of where we store to this
+ property in normal object storage without reifying the static property table.
+ The fix here is simple: we first check if the Structure's property table
+ has this property, and if so, return false.
+
+ This patch also renames CustomFunctionEquivalence to HasStaticProperty to
+ better capture what we're doing.
+
+ * bytecode/ObjectPropertyCondition.h:
+ (JSC::ObjectPropertyCondition::hasStaticProperty):
+ (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
+ * bytecode/ObjectPropertyConditionSet.cpp:
+ (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const):
+ (JSC::ObjectPropertyConditionSet::slotBaseCondition const):
+ (JSC::generateConditionsForPrototypePropertyHitCustom):
+ * bytecode/PropertyCondition.cpp:
+ (JSC::PropertyCondition::dumpInContext const):
+ (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
+ (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
+ (JSC::PropertyCondition::isStillValid const):
+ (JSC::PropertyCondition::isWatchableWhenValid const):
+ (WTF::printInternal):
+ * bytecode/PropertyCondition.h:
+ (JSC::PropertyCondition::hasStaticProperty):
+ (JSC::PropertyCondition::hash const):
+ (JSC::PropertyCondition::operator== const):
+ (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
+ * tools/JSDollarVM.cpp:
+ (JSC::functionCreateStaticCustomValue):
+ (JSC::JSDollarVM::finishCreation):
+
+2020-09-25 Alan Coon <[email protected]>
+
Cherry-pick r266813. rdar://problem/69582551
OutOfBoundsSaneChain operations should use their own heap locations
Modified: branches/safari-610-branch/Source/_javascript_Core/bytecode/ObjectPropertyCondition.h (267634 => 267635)
--- branches/safari-610-branch/Source/_javascript_Core/bytecode/ObjectPropertyCondition.h 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/Source/_javascript_Core/bytecode/ObjectPropertyCondition.h 2020-09-26 21:08:52 UTC (rev 267635)
@@ -122,12 +122,12 @@
return equivalenceWithoutBarrier(object, uid, value);
}
- static ObjectPropertyCondition customFunctionEquivalence(
+ static ObjectPropertyCondition hasStaticProperty(
VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid)
{
ObjectPropertyCondition result;
result.m_object = object;
- result.m_condition = PropertyCondition::customFunctionEquivalence(uid);
+ result.m_condition = PropertyCondition::hasStaticProperty(uid);
if (owner)
vm.heap.writeBarrier(owner);
return result;
Modified: branches/safari-610-branch/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.cpp (267634 => 267635)
--- branches/safari-610-branch/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.cpp 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.cpp 2020-09-26 21:08:52 UTC (rev 267635)
@@ -67,7 +67,7 @@
switch (condition.kind()) {
case PropertyCondition::Presence:
case PropertyCondition::Equivalence:
- case PropertyCondition::CustomFunctionEquivalence:
+ case PropertyCondition::HasStaticProperty:
if (sawBase)
return false;
sawBase = true;
@@ -87,7 +87,7 @@
for (const ObjectPropertyCondition& condition : *this) {
if (condition.kind() == PropertyCondition::Presence
|| condition.kind() == PropertyCondition::Equivalence
- || condition.kind() == PropertyCondition::CustomFunctionEquivalence) {
+ || condition.kind() == PropertyCondition::HasStaticProperty) {
result = condition;
numFound++;
}
@@ -244,11 +244,11 @@
result = ObjectPropertyCondition::equivalence(vm, owner, object, uid, value);
break;
}
- case PropertyCondition::CustomFunctionEquivalence: {
+ case PropertyCondition::HasStaticProperty: {
auto entry = object->findPropertyHashEntry(vm, uid);
if (!entry)
return ObjectPropertyCondition();
- result = ObjectPropertyCondition::customFunctionEquivalence(vm, owner, object, uid);
+ result = ObjectPropertyCondition::hasStaticProperty(vm, owner, object, uid);
break;
}
default:
@@ -409,7 +409,7 @@
kind = PropertyCondition::Equivalence;
} else if (structure->findPropertyHashEntry(uid))
- kind = PropertyCondition::CustomFunctionEquivalence;
+ kind = PropertyCondition::HasStaticProperty;
else if (attributes & PropertyAttribute::DontDelete) {
// This can't change, so we can blindly cache it.
return true;
Modified: branches/safari-610-branch/Source/_javascript_Core/bytecode/PropertyCondition.cpp (267634 => 267635)
--- branches/safari-610-branch/Source/_javascript_Core/bytecode/PropertyCondition.cpp 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/Source/_javascript_Core/bytecode/PropertyCondition.cpp 2020-09-26 21:08:52 UTC (rev 267635)
@@ -54,7 +54,7 @@
case Equivalence:
out.print(m_header.type(), " of ", m_header.pointer(), " with ", inContext(requiredValue(), context));
return;
- case CustomFunctionEquivalence:
+ case HasStaticProperty:
out.print(m_header.type(), " of ", m_header.pointer());
return;
case HasPrototype:
@@ -89,7 +89,7 @@
case Absence:
case AbsenceOfSetEffect:
case Equivalence:
- case CustomFunctionEquivalence:
+ case HasStaticProperty:
if (!structure->propertyAccessesAreCacheable()) {
if (PropertyConditionInternal::verbose)
dataLog("Invalid because property accesses are not cacheable.\n");
@@ -253,7 +253,9 @@
return true;
}
- case CustomFunctionEquivalence: {
+ case HasStaticProperty: {
+ if (isValidOffset(structure->getConcurrently(uid())))
+ return false;
if (structure->staticPropertiesReified())
return false;
return !!structure->findPropertyHashEntry(uid());
@@ -273,7 +275,7 @@
case Presence:
case Absence:
case Equivalence:
- case CustomFunctionEquivalence:
+ case HasStaticProperty:
return structure->needImpurePropertyWatchpoint();
case AbsenceOfSetEffect:
case HasPrototype:
@@ -299,7 +301,7 @@
break;
case Presence:
case Equivalence:
- case CustomFunctionEquivalence:
+ case HasStaticProperty:
if (structure->typeInfo().getOwnPropertySlotIsImpure())
return false;
break;
@@ -342,7 +344,7 @@
break;
}
- case CustomFunctionEquivalence: {
+ case HasStaticProperty: {
// We just use the structure transition watchpoint for this. A structure S starts
// off with a property P in the static property hash table. If S transitions to
// S', either P remains in the static property table or not. If not, then we
@@ -430,8 +432,8 @@
case JSC::PropertyCondition::Equivalence:
out.print("Equivalence");
return;
- case JSC::PropertyCondition::CustomFunctionEquivalence:
- out.print("CustomFunctionEquivalence");
+ case JSC::PropertyCondition::HasStaticProperty:
+ out.print("HasStaticProperty");
return;
case JSC::PropertyCondition::HasPrototype:
out.print("HasPrototype");
Modified: branches/safari-610-branch/Source/_javascript_Core/bytecode/PropertyCondition.h (267634 => 267635)
--- branches/safari-610-branch/Source/_javascript_Core/bytecode/PropertyCondition.h 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/Source/_javascript_Core/bytecode/PropertyCondition.h 2020-09-26 21:08:52 UTC (rev 267635)
@@ -40,7 +40,7 @@
Absence,
AbsenceOfSetEffect,
Equivalence, // An adaptive watchpoint on this will be a pair of watchpoints, and when the structure transitions, we will set the replacement watchpoint on the new structure.
- CustomFunctionEquivalence, // Custom value or accessor.
+ HasStaticProperty, // Custom value or accessor.
HasPrototype
};
@@ -124,10 +124,10 @@
return equivalenceWithoutBarrier(uid, value);
}
- static PropertyCondition customFunctionEquivalence(UniquedStringImpl* uid)
+ static PropertyCondition hasStaticProperty(UniquedStringImpl* uid)
{
PropertyCondition result;
- result.m_header = Header(uid, CustomFunctionEquivalence);
+ result.m_header = Header(uid, HasStaticProperty);
return result;
}
@@ -201,7 +201,7 @@
case Equivalence:
result ^= EncodedJSValueHash::hash(u.equivalence.value);
break;
- case CustomFunctionEquivalence:
+ case HasStaticProperty:
break;
}
return result;
@@ -223,7 +223,7 @@
return u.prototype.prototype == other.u.prototype.prototype;
case Equivalence:
return u.equivalence.value == other.u.equivalence.value;
- case CustomFunctionEquivalence:
+ case HasStaticProperty:
return true;
}
RELEASE_ASSERT_NOT_REACHED();
Modified: branches/safari-610-branch/Source/_javascript_Core/tools/JSDollarVM.cpp (267634 => 267635)
--- branches/safari-610-branch/Source/_javascript_Core/tools/JSDollarVM.cpp 2020-09-26 21:08:49 UTC (rev 267634)
+++ branches/safari-610-branch/Source/_javascript_Core/tools/JSDollarVM.cpp 2020-09-26 21:08:52 UTC (rev 267635)
@@ -738,6 +738,69 @@
}
};
+static EncodedJSValue testStaticValueGetter(JSGlobalObject*, EncodedJSValue, PropertyName)
+{
+ DollarVMAssertScope assertScope;
+ return JSValue::encode(jsUndefined());
+}
+
+static bool testStaticValuePutter(JSGlobalObject* globalObject, EncodedJSValue thisValue, EncodedJSValue value)
+{
+ DollarVMAssertScope assertScope;
+ VM& vm = globalObject->vm();
+
+ JSObject* thisObject = jsDynamicCast<JSObject*>(vm, JSValue::decode(thisValue));
+ RELEASE_ASSERT(thisObject);
+
+ return thisObject->putDirect(vm, PropertyName(Identifier::fromString(vm, "testStaticValue")), JSValue::decode(value));
+}
+
+static const struct CompactHashIndex staticCustomValueTableIndex[2] = {
+ { 0, -1 },
+ { -1, -1 },
+};
+
+static const struct HashTableValue staticCustomValueTableValues[1] = {
+ { "testStaticValue", static_cast<unsigned>(PropertyAttribute::CustomAccessor), NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(testStaticValueGetter), (intptr_t)static_cast<PutPropertySlot::PutValueFunc>(testStaticValuePutter) } },
+};
+
+static const struct HashTable staticCustomValueTable =
+ { 1, 1, true, nullptr, staticCustomValueTableValues, staticCustomValueTableIndex };
+
+class StaticCustomValue : public JSNonFinalObject {
+ using Base = JSNonFinalObject;
+public:
+ StaticCustomValue(VM& vm, Structure* structure)
+ : Base(vm, structure)
+ {
+ DollarVMAssertScope assertScope;
+ }
+
+ DECLARE_INFO;
+
+ static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+ template<typename CellType, SubspaceAccess>
+ static CompleteSubspace* subspaceFor(VM& vm)
+ {
+ return &vm.cellSpace;
+ }
+
+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+ {
+ DollarVMAssertScope assertScope;
+ return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+ }
+
+ static StaticCustomValue* create(VM& vm, Structure* structure)
+ {
+ DollarVMAssertScope assertScope;
+ StaticCustomValue* accessor = new (NotNull, allocateCell<StaticCustomValue>(vm.heap)) StaticCustomValue(vm, structure);
+ accessor->finishCreation(vm);
+ return accessor;
+ }
+};
+
class ObjectDoingSideEffectPutWithoutCorrectSlotStatus : public JSNonFinalObject {
using Base = JSNonFinalObject;
public:
@@ -1544,6 +1607,7 @@
const ClassInfo JSTestCustomGetterSetter::s_info = { "JSTestCustomGetterSetter", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSTestCustomGetterSetter) };
const ClassInfo StaticCustomAccessor::s_info = { "StaticCustomAccessor", &Base::s_info, &staticCustomAccessorTable, nullptr, CREATE_METHOD_TABLE(StaticCustomAccessor) };
+const ClassInfo StaticCustomValue::s_info = { "StaticCustomValue", &Base::s_info, &staticCustomValueTable, nullptr, CREATE_METHOD_TABLE(StaticCustomValue) };
const ClassInfo ObjectDoingSideEffectPutWithoutCorrectSlotStatus::s_info = { "ObjectDoingSideEffectPutWithoutCorrectSlotStatus", &Base::s_info, &staticCustomAccessorTable, nullptr, CREATE_METHOD_TABLE(ObjectDoingSideEffectPutWithoutCorrectSlotStatus) };
ElementHandleOwner* Element::handleOwner()
@@ -2531,6 +2595,16 @@
return JSValue::encode(result);
}
+static EncodedJSValue JSC_HOST_CALL functionCreateStaticCustomValue(JSGlobalObject* globalObject, CallFrame*)
+{
+ DollarVMAssertScope assertScope;
+ VM& vm = globalObject->vm();
+ JSLockHolder lock(vm);
+ Structure* structure = StaticCustomValue::createStructure(vm, globalObject, jsNull());
+ auto* result = StaticCustomValue::create(vm, structure);
+ return JSValue::encode(result);
+}
+
static EncodedJSValue JSC_HOST_CALL functionCreateObjectDoingSideEffectPutWithoutCorrectSlotStatus(JSGlobalObject* globalObject, CallFrame* callFrame)
{
DollarVMAssertScope assertScope;
@@ -3232,6 +3306,7 @@
addFunction(vm, "createWasmStreamingParser", functionCreateWasmStreamingParser, 0);
#endif
addFunction(vm, "createStaticCustomAccessor", functionCreateStaticCustomAccessor, 0);
+ addFunction(vm, "createStaticCustomValue", functionCreateStaticCustomValue, 0);
addFunction(vm, "createObjectDoingSideEffectPutWithoutCorrectSlotStatus", functionCreateObjectDoingSideEffectPutWithoutCorrectSlotStatus, 0);
addFunction(vm, "createEmptyFunctionWithName", functionCreateEmptyFunctionWithName, 1);
addFunction(vm, "getPrivateProperty", functionGetPrivateProperty, 2);
