Title: [272428] trunk
- Revision
- 272428
- Author
- [email protected]
- Date
- 2021-02-05 10:58:06 -0800 (Fri, 05 Feb 2021)
Log Message
[JSC] globalFuncCopyDataProperties should not perform GC-sensitive operation in the middle of Structure::forEachProperty
https://bugs.webkit.org/show_bug.cgi?id=221454
Reviewed by Mark Lam.
JSTests:
* stress/copy-data-properties-fast-path.js: Added.
(foo):
Source/_javascript_Core:
isPropertyNameExcluded can invoke GC etc. And running Structure::forEachProperty
is fragile state against any side-effect including GC.
We should not perform GC-sensitive operation during Structure::forEachProperty.
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (272427 => 272428)
--- trunk/JSTests/ChangeLog 2021-02-05 18:53:42 UTC (rev 272427)
+++ trunk/JSTests/ChangeLog 2021-02-05 18:58:06 UTC (rev 272428)
@@ -1,3 +1,13 @@
+2021-02-05 Yusuke Suzuki <[email protected]>
+
+ [JSC] globalFuncCopyDataProperties should not perform GC-sensitive operation in the middle of Structure::forEachProperty
+ https://bugs.webkit.org/show_bug.cgi?id=221454
+
+ Reviewed by Mark Lam.
+
+ * stress/copy-data-properties-fast-path.js: Added.
+ (foo):
+
2021-02-05 Alexey Shvayka <[email protected]>
Object.assign should throw for property creation on non-extensible `target`
Added: trunk/JSTests/stress/copy-data-properties-fast-path.js (0 => 272428)
--- trunk/JSTests/stress/copy-data-properties-fast-path.js (rev 0)
+++ trunk/JSTests/stress/copy-data-properties-fast-path.js 2021-02-05 18:58:06 UTC (rev 272428)
@@ -0,0 +1,7 @@
+//@ runDefault("--slowPathAllocsBetweenGCs=4", "--watchdog=100", "--watchdog-exception-ok")
+
+function foo() {
+ let { ...r } = { xx:0 };
+ foo();
+}
+foo();
Modified: trunk/Source/_javascript_Core/ChangeLog (272427 => 272428)
--- trunk/Source/_javascript_Core/ChangeLog 2021-02-05 18:53:42 UTC (rev 272427)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-02-05 18:58:06 UTC (rev 272428)
@@ -1,3 +1,17 @@
+2021-02-05 Yusuke Suzuki <[email protected]>
+
+ [JSC] globalFuncCopyDataProperties should not perform GC-sensitive operation in the middle of Structure::forEachProperty
+ https://bugs.webkit.org/show_bug.cgi?id=221454
+
+ Reviewed by Mark Lam.
+
+ isPropertyNameExcluded can invoke GC etc. And running Structure::forEachProperty
+ is fragile state against any side-effect including GC.
+ We should not perform GC-sensitive operation during Structure::forEachProperty.
+
+ * runtime/JSGlobalObjectFunctions.cpp:
+ (JSC::JSC_DEFINE_HOST_FUNCTION):
+
2021-02-05 Alexey Shvayka <[email protected]>
Object.assign should throw for property creation on non-extensible `target`
Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp (272427 => 272428)
--- trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp 2021-02-05 18:53:42 UTC (rev 272427)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp 2021-02-05 18:58:06 UTC (rev 272428)
@@ -885,10 +885,6 @@
if (propertyName.isPrivateName())
return true;
- bool excluded = isPropertyNameExcluded(globalObject, propertyName);
- RETURN_IF_EXCEPTION(scope, false);
- if (excluded)
- return true;
if (entry.attributes & PropertyAttribute::DontEnum)
return true;
@@ -902,6 +898,10 @@
for (size_t i = 0; i < properties.size(); ++i) {
// FIXME: We could put properties in a batching manner to accelerate CopyDataProperties more.
// https://bugs.webkit.org/show_bug.cgi?id=185358
+ bool excluded = isPropertyNameExcluded(globalObject, properties[i].get());
+ RETURN_IF_EXCEPTION(scope, { });
+ if (excluded)
+ continue;
target->putDirect(vm, properties[i].get(), values.at(i));
}
} else {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
