Title: [271308] branches/safari-610.4.3.0-branch/Source/_javascript_Core
- Revision
- 271308
- Author
- [email protected]
- Date
- 2021-01-08 11:52:57 -0800 (Fri, 08 Jan 2021)
Log Message
Cherry-pick r271144. rdar://problem/72935400
propertyNameEnumerator must check it can still take the fast path after getGenericPropertyNames
https://bugs.webkit.org/show_bug.cgi?id=219957
<rdar://71156284>
Reviewed by Yusuke Suzuki.
We need to check if we still `canAccessPropertiesQuicklyForEnumeration` on
`structureAfterGettingPropertyNames`, since we might call out out to a proxy's
`getPrototypeOf` callback through `getGenericPropertyNames`.
* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@271144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-610.4.3.0-branch/Source/_javascript_Core/ChangeLog (271307 => 271308)
--- branches/safari-610.4.3.0-branch/Source/_javascript_Core/ChangeLog 2021-01-08 19:37:21 UTC (rev 271307)
+++ branches/safari-610.4.3.0-branch/Source/_javascript_Core/ChangeLog 2021-01-08 19:52:57 UTC (rev 271308)
@@ -1,3 +1,37 @@
+2021-01-08 Kocsen Chung <[email protected]>
+
+ Cherry-pick r271144. rdar://problem/72935400
+
+ propertyNameEnumerator must check it can still take the fast path after getGenericPropertyNames
+ https://bugs.webkit.org/show_bug.cgi?id=219957
+ <rdar://71156284>
+
+ Reviewed by Yusuke Suzuki.
+
+ We need to check if we still `canAccessPropertiesQuicklyForEnumeration` on
+ `structureAfterGettingPropertyNames`, since we might call out out to a proxy's
+ `getPrototypeOf` callback through `getGenericPropertyNames`.
+
+ * runtime/JSPropertyNameEnumerator.h:
+ (JSC::propertyNameEnumerator):
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@271144 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-12-16 Tadeu Zagallo <[email protected]>
+
+ propertyNameEnumerator must check it can still take the fast path after getGenericPropertyNames
+ https://bugs.webkit.org/show_bug.cgi?id=219957
+ <rdar://71156284>
+
+ Reviewed by Yusuke Suzuki.
+
+ We need to check if we still `canAccessPropertiesQuicklyForEnumeration` on
+ `structureAfterGettingPropertyNames`, since we might call out out to a proxy's
+ `getPrototypeOf` callback through `getGenericPropertyNames`.
+
+ * runtime/JSPropertyNameEnumerator.h:
+ (JSC::propertyNameEnumerator):
+
2021-01-07 Alan Coon <[email protected]>
Cherry-pick r271143. rdar://problem/72893965
Modified: branches/safari-610.4.3.0-branch/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h (271307 => 271308)
--- branches/safari-610.4.3.0-branch/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h 2021-01-08 19:37:21 UTC (rev 271307)
+++ branches/safari-610.4.3.0-branch/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h 2021-01-08 19:52:57 UTC (rev 271308)
@@ -141,6 +141,11 @@
bool successfullyNormalizedChain = normalizePrototypeChain(globalObject, base, sawPolyProto) != InvalidPrototypeChain;
Structure* structureAfterGettingPropertyNames = base->structure(vm);
+ if (!structureAfterGettingPropertyNames->canAccessPropertiesQuicklyForEnumeration()) {
+ indexedLength = 0;
+ numberStructureProperties = 0;
+ }
+
enumerator = JSPropertyNameEnumerator::create(vm, structureAfterGettingPropertyNames, indexedLength, numberStructureProperties, WTFMove(propertyNames));
if (!indexedLength && successfullyNormalizedChain && structureAfterGettingPropertyNames == structure) {
enumerator->setCachedPrototypeChain(vm, structure->prototypeChain(globalObject, base));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
