Title: [274637] releases/WebKitGTK/webkit-2.30/Source/_javascript_Core
- Revision
- 274637
- Author
- [email protected]
- Date
- 2021-03-18 04:04:36 -0700 (Thu, 18 Mar 2021)
Log Message
Merge r271144 - propertyNameEnumerator must check it can still take the fast path after getGenericPropertyNames
https://bugs.webkit.org/show_bug.cgi?id=219957
<rdar://71156284>
Reviewed by Yusuke Suzuki.
We need to check if we still `canAccessPropertiesQuicklyForEnumeration` on
`structureAfterGettingPropertyNames`, since we might call out out to a proxy's
`getPrototypeOf` callback through `getGenericPropertyNames`.
* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.30/Source/_javascript_Core/ChangeLog (274636 => 274637)
--- releases/WebKitGTK/webkit-2.30/Source/_javascript_Core/ChangeLog 2021-03-18 11:04:32 UTC (rev 274636)
+++ releases/WebKitGTK/webkit-2.30/Source/_javascript_Core/ChangeLog 2021-03-18 11:04:36 UTC (rev 274637)
@@ -1,3 +1,18 @@
+2020-12-16 Tadeu Zagallo <[email protected]>
+
+ propertyNameEnumerator must check it can still take the fast path after getGenericPropertyNames
+ https://bugs.webkit.org/show_bug.cgi?id=219957
+ <rdar://71156284>
+
+ Reviewed by Yusuke Suzuki.
+
+ We need to check if we still `canAccessPropertiesQuicklyForEnumeration` on
+ `structureAfterGettingPropertyNames`, since we might call out out to a proxy's
+ `getPrototypeOf` callback through `getGenericPropertyNames`.
+
+ * runtime/JSPropertyNameEnumerator.h:
+ (JSC::propertyNameEnumerator):
+
2020-12-02 Michael Catanzaro <[email protected]>
aarch64 llint does not build with JIT disabled
Modified: releases/WebKitGTK/webkit-2.30/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h (274636 => 274637)
--- releases/WebKitGTK/webkit-2.30/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h 2021-03-18 11:04:32 UTC (rev 274636)
+++ releases/WebKitGTK/webkit-2.30/Source/_javascript_Core/runtime/JSPropertyNameEnumerator.h 2021-03-18 11:04:36 UTC (rev 274637)
@@ -141,6 +141,11 @@
bool successfullyNormalizedChain = normalizePrototypeChain(globalObject, base, sawPolyProto) != InvalidPrototypeChain;
Structure* structureAfterGettingPropertyNames = base->structure(vm);
+ if (!structureAfterGettingPropertyNames->canAccessPropertiesQuicklyForEnumeration()) {
+ indexedLength = 0;
+ numberStructureProperties = 0;
+ }
+
enumerator = JSPropertyNameEnumerator::create(vm, structureAfterGettingPropertyNames, indexedLength, numberStructureProperties, WTFMove(propertyNames));
if (!indexedLength && successfullyNormalizedChain && structureAfterGettingPropertyNames == structure) {
enumerator->setCachedPrototypeChain(vm, structure->prototypeChain(globalObject, base));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
