Title: [280280] trunk
Revision
280280
Author
[email protected]
Date
2021-07-23 18:56:31 -0700 (Fri, 23 Jul 2021)

Log Message

[WebIDL] Properly validate and merge descriptors in [Replaceable] setter
https://bugs.webkit.org/show_bug.cgi?id=227662

Reviewed by Sam Weinig.

Source/_javascript_Core:

Extracts createDataProperty() method to keep WebIDL code generator as simple as possible,
and also to emphasize a subtle difference between
{ [[Value]]: X } and
{ [[Value]]: X, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true }.

* runtime/JSONObject.cpp:
(JSC::Walker::walk):
* runtime/JSObject.cpp:
(JSC::definePropertyOnReceiverSlow):
* runtime/JSObject.h:
* runtime/JSObjectInlines.h:
(JSC::JSObject::createDataProperty):
* runtime/Lookup.h:
(JSC::replaceStaticPropertySlot): Deleted.

Source/WebCore:

The previous implementation relied on an invariant that structure property is absent
when [Replaceable] setter is called, which is no longer guaranteed after the introduction
of Object.defineProperty.

This patch replaces putDirect() with defineOwnProperty(), fixing the compliance with
invariants of internal methods [1]: an accessor property once observed as non-configurable
can't be reconfigured to have [[Value]]. Both Chrome and Firefox properly validate descriptors.

Although [[DefineOwnProperty]] failure is silently ignored by Chrome and the spec [2], WebKit now
throws a TypeError, which is a desired behavior for built-ins and was proven to be web-compatible
by Firefox. With WebKit being the second implementation that throws, the spec can be tightened.

After r264574, attributeChangeTransition() is called during defineOwnProperty(), ensuring inline
caching is correct. Also, this change adjusts `window.opener` setter [3].

[1] https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods
[2] https://heycam.github.io/webidl/#dfn-attribute-setter (step 4.5.5)
[3] https://html.spec.whatwg.org/multipage/browsers.html#dom-opener

Tests: fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html
       fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html
       fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html

* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::setOpener):
(WebCore::JSDOMWindow::setOpenDatabase):
* bindings/scripts/CodeGeneratorJS.pm:
(AttributeSetterNeedsPropertyName):
(GenerateAttributeSetterBodyDefinition):
(GenerateAttributeSetterTrampolineDefinition):
* bindings/scripts/test/JS/JSTestObj.cpp:

LayoutTests:

* fast/dom/replaceable-setter-throws-if-defineownproperty-fails-expected.txt: Added.
* fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html: Added.
* fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1-expected.txt: Added.
* fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html: Added.
* fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2-expected.txt: Added.
* fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html: Added.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (280279 => 280280)


--- trunk/LayoutTests/ChangeLog	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/LayoutTests/ChangeLog	2021-07-24 01:56:31 UTC (rev 280280)
@@ -1,3 +1,17 @@
+2021-07-23  Alexey Shvayka  <[email protected]>
+
+        [WebIDL] Properly validate and merge descriptors in [Replaceable] setter
+        https://bugs.webkit.org/show_bug.cgi?id=227662
+
+        Reviewed by Sam Weinig.
+
+        * fast/dom/replaceable-setter-throws-if-defineownproperty-fails-expected.txt: Added.
+        * fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html: Added.
+        * fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1-expected.txt: Added.
+        * fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html: Added.
+        * fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2-expected.txt: Added.
+        * fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html: Added.
+
 2021-07-23  Eric Hutchison  <[email protected]>
 
         [BigSur wk1 Debug ] imported/w3c/web-platform-tests/IndexedDB/idb_binary_key_conversion.htm is a flaky timeout .

Added: trunk/LayoutTests/fast/dom/replaceable-setter-throws-if-defineownproperty-fails-expected.txt (0 => 280280)


--- trunk/LayoutTests/fast/dom/replaceable-setter-throws-if-defineownproperty-fails-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/replaceable-setter-throws-if-defineownproperty-fails-expected.txt	2021-07-24 01:56:31 UTC (rev 280280)
@@ -0,0 +1,10 @@
+
+PASS window.self setter throws TypeError if called on non-configurable accessor property
+PASS window.parent setter throws TypeError if called on non-configurable accessor property
+PASS window.origin setter throws TypeError if called on non-configurable accessor property
+PASS window.innerWidth setter throws TypeError if called on non-configurable accessor property
+PASS window.screen setter throws TypeError if called on non-configurable non-writable data property
+PASS window.length setter throws TypeError if called on non-configurable non-writable data property
+PASS window.event setter throws TypeError if called on non-configurable non-writable data property
+PASS window.outerHeight setter throws TypeError if called on non-configurable non-writable data property
+

Added: trunk/LayoutTests/fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html (0 => 280280)


--- trunk/LayoutTests/fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html	2021-07-24 01:56:31 UTC (rev 280280)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>[Replaceable] setter throws TypeError if [[DefineOwnProperty]] fails</title>
+<link rel="help" href=""
+
+<script src=""
+<script src=""
+
+<body>
+<script>
+for (const key of ["self", "parent", "origin", "innerWidth"]) {
+    test(() => {
+        Object.defineProperty(window, key, { configurable: false });
+        assert_throws(new TypeError, () => { window[key] = 1; });
+
+        const desc = Object.getOwnPropertyDescriptor(window, key);
+        assert_false("value" in desc);
+        assert_equals(typeof desc.get, "function");
+        assert_equals(typeof desc.set, "function");
+        assert_true(desc.enumerable);
+        assert_false(desc.configurable);
+    }, `window.${key} setter throws TypeError if called on non-configurable accessor property`);
+}
+
+for (const key of ["screen", "length", "event", "outerHeight"]) {
+    test(() => {
+        const { set } = Object.getOwnPropertyDescriptor(window, key);
+        Object.defineProperty(window, key, { value: 1, writable: false, configurable: false });
+        assert_throws(new TypeError, () => { set.call(window, 2); });
+
+        const desc = Object.getOwnPropertyDescriptor(window, key);
+        assert_equals(desc.value, 1);
+        assert_false(desc.writable);
+        assert_true(desc.enumerable);
+        assert_false(desc.configurable);
+    }, `window.${key} setter throws TypeError if called on non-configurable non-writable data property`);
+}
+</script>

Added: trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1-expected.txt (0 => 280280)


--- trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1-expected.txt	2021-07-24 01:56:31 UTC (rev 280280)
@@ -0,0 +1,3 @@
+
+PASS window.opener setter throws TypeError if called on non-configurable accessor property
+

Added: trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html (0 => 280280)


--- trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html	2021-07-24 01:56:31 UTC (rev 280280)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>window.opener setter throws TypeError if [[DefineOwnProperty]] fails</title>
+<link rel="help" href=""
+
+<script src=""
+<script src=""
+
+<body>
+<script>
+test(() => {
+    Object.defineProperty(window, "opener", { configurable: false });
+    assert_throws(new TypeError, () => { window.opener = 1; });
+
+    const desc = Object.getOwnPropertyDescriptor(window, "opener");
+    assert_false("value" in desc);
+    assert_equals(typeof desc.get, "function");
+    assert_equals(typeof desc.set, "function");
+    assert_true(desc.enumerable);
+    assert_false(desc.configurable);
+}, "window.opener setter throws TypeError if called on non-configurable accessor property");
+</script>

Added: trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2-expected.txt (0 => 280280)


--- trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2-expected.txt	2021-07-24 01:56:31 UTC (rev 280280)
@@ -0,0 +1,3 @@
+
+PASS window.opener setter throws TypeError if called on non-configurable non-writable data property
+

Added: trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html (0 => 280280)


--- trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html	                        (rev 0)
+++ trunk/LayoutTests/fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html	2021-07-24 01:56:31 UTC (rev 280280)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>window.opener setter throws TypeError if [[DefineOwnProperty]] fails</title>
+<link rel="help" href=""
+
+<script src=""
+<script src=""
+
+<body>
+<script>
+test(() => {
+    const { set } = Object.getOwnPropertyDescriptor(window, "opener");
+    Object.defineProperty(window, "opener", { value: 1, writable: false, configurable: false });
+    assert_throws(new TypeError, () => { set.call(window, 2); });
+
+    const desc = Object.getOwnPropertyDescriptor(window, "opener");
+    assert_equals(desc.value, 1);
+    assert_false(desc.writable);
+    assert_true(desc.enumerable);
+    assert_false(desc.configurable);
+}, "window.opener setter throws TypeError if called on non-configurable non-writable data property");
+</script>

Modified: trunk/Source/_javascript_Core/ChangeLog (280279 => 280280)


--- trunk/Source/_javascript_Core/ChangeLog	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/_javascript_Core/ChangeLog	2021-07-24 01:56:31 UTC (rev 280280)
@@ -1,5 +1,27 @@
 2021-07-23  Alexey Shvayka  <[email protected]>
 
+        [WebIDL] Properly validate and merge descriptors in [Replaceable] setter
+        https://bugs.webkit.org/show_bug.cgi?id=227662
+
+        Reviewed by Sam Weinig.
+
+        Extracts createDataProperty() method to keep WebIDL code generator as simple as possible,
+        and also to emphasize a subtle difference between
+        { [[Value]]: X } and
+        { [[Value]]: X, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true }.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::definePropertyOnReceiverSlow):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::createDataProperty):
+        * runtime/Lookup.h:
+        (JSC::replaceStaticPropertySlot): Deleted.
+
+2021-07-23  Alexey Shvayka  <[email protected]>
+
         [JSC] Call custom accessors / values with their holder's global object
         https://bugs.webkit.org/show_bug.cgi?id=225997
 

Modified: trunk/Source/_javascript_Core/runtime/JSONObject.cpp (280279 => 280280)


--- trunk/Source/_javascript_Core/runtime/JSONObject.cpp	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/_javascript_Core/runtime/JSONObject.cpp	2021-07-24 01:56:31 UTC (rev 280280)
@@ -753,9 +753,8 @@
                     if (LIKELY(offset != invalidOffset && attributes == static_cast<unsigned>(PropertyAttribute::None)))
                         object->putDirect(vm, offset, filteredValue);
                     else {
-                        PropertyDescriptor descriptor(filteredValue, static_cast<unsigned>(PropertyAttribute::None));
                         bool shouldThrow = false;
-                        object->methodTable(vm)->defineOwnProperty(object, m_globalObject, prop, descriptor, shouldThrow);
+                        object->createDataProperty(m_globalObject, prop, filteredValue, shouldThrow);
                     }
                 }
                 RETURN_IF_EXCEPTION(scope, { });

Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (280279 => 280280)


--- trunk/Source/_javascript_Core/runtime/JSObject.cpp	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp	2021-07-24 01:56:31 UTC (rev 280280)
@@ -869,16 +869,17 @@
     bool hasProperty = receiver->methodTable(vm)->getOwnPropertySlot(receiver, globalObject, propertyName, slot);
     RETURN_IF_EXCEPTION(scope, false);
 
-    PropertyDescriptor descriptor;
     if (hasProperty) {
         // FIXME: For an accessor with setter, the error message is misleading.
         if (slot.attributes() & PropertyAttribute::ReadOnlyOrAccessorOrCustomAccessor)
             return typeError(globalObject, scope, shouldThrow, ReadonlyPropertyWriteError);
+
+        PropertyDescriptor descriptor;
         descriptor.setValue(value);
-    } else
-        descriptor.setDescriptor(value, static_cast<unsigned>(PropertyAttribute::None));
+        RELEASE_AND_RETURN(scope, receiver->methodTable(vm)->defineOwnProperty(receiver, globalObject, propertyName, descriptor, shouldThrow));
+    }
 
-    RELEASE_AND_RETURN(scope, receiver->methodTable(vm)->defineOwnProperty(receiver, globalObject, propertyName, descriptor, shouldThrow));
+    RELEASE_AND_RETURN(scope, receiver->createDataProperty(globalObject, propertyName, value, shouldThrow));
 }
 
 // https://tc39.es/ecma262/#sec-ordinaryset (step 3)

Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (280279 => 280280)


--- trunk/Source/_javascript_Core/runtime/JSObject.h	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h	2021-07-24 01:56:31 UTC (rev 280280)
@@ -809,6 +809,7 @@
     JSFunction* putDirectBuiltinFunctionWithoutTransition(VM&, JSGlobalObject*, const PropertyName&, FunctionExecutable*, unsigned attributes);
 
     JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, JSGlobalObject*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    bool createDataProperty(JSGlobalObject*, PropertyName, JSValue, bool shouldThrow);
 
     bool isEnvironment() const;
     bool isGlobalObject() const;

Modified: trunk/Source/_javascript_Core/runtime/JSObjectInlines.h (280279 => 280280)


--- trunk/Source/_javascript_Core/runtime/JSObjectInlines.h	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/_javascript_Core/runtime/JSObjectInlines.h	2021-07-24 01:56:31 UTC (rev 280280)
@@ -288,6 +288,13 @@
     return true;
 }
 
+// https://tc39.es/ecma262/#sec-createdataproperty
+ALWAYS_INLINE bool JSObject::createDataProperty(JSGlobalObject* globalObject, PropertyName propertyName, JSValue value, bool shouldThrow)
+{
+    PropertyDescriptor descriptor(value, static_cast<unsigned>(PropertyAttribute::None));
+    return methodTable(getVM(globalObject))->defineOwnProperty(this, globalObject, propertyName, descriptor, shouldThrow);
+}
+
 // HasOwnProperty(O, P) from section 7.3.11 in the spec.
 // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasownproperty
 ALWAYS_INLINE bool JSObject::hasOwnProperty(JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot) const

Modified: trunk/Source/_javascript_Core/runtime/Lookup.h (280279 => 280280)


--- trunk/Source/_javascript_Core/runtime/Lookup.h	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/_javascript_Core/runtime/Lookup.h	2021-07-24 01:56:31 UTC (rev 280280)
@@ -251,17 +251,6 @@
     return true;
 }
 
-inline bool replaceStaticPropertySlot(VM& vm, JSObject* thisObject, PropertyName propertyName, JSValue value)
-{
-    if (!thisObject->putDirect(vm, propertyName, value))
-        return false;
-
-    if (!thisObject->staticPropertiesReified(vm))
-        thisObject->JSObject::setStructure(vm, Structure::attributeChangeTransition(vm, thisObject->structure(vm), propertyName, 0));
-
-    return true;
-}
-
 inline void reifyStaticProperty(VM& vm, const ClassInfo* classInfo, const PropertyName& propertyName, const HashTableValue& value, JSObject& thisObj)
 {
     if (value.attributes() & PropertyAttribute::Builtin) {

Modified: trunk/Source/WebCore/ChangeLog (280279 => 280280)


--- trunk/Source/WebCore/ChangeLog	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/WebCore/ChangeLog	2021-07-24 01:56:31 UTC (rev 280280)
@@ -1,3 +1,42 @@
+2021-07-23  Alexey Shvayka  <[email protected]>
+
+        [WebIDL] Properly validate and merge descriptors in [Replaceable] setter
+        https://bugs.webkit.org/show_bug.cgi?id=227662
+
+        Reviewed by Sam Weinig.
+
+        The previous implementation relied on an invariant that structure property is absent
+        when [Replaceable] setter is called, which is no longer guaranteed after the introduction
+        of Object.defineProperty.
+
+        This patch replaces putDirect() with defineOwnProperty(), fixing the compliance with
+        invariants of internal methods [1]: an accessor property once observed as non-configurable
+        can't be reconfigured to have [[Value]]. Both Chrome and Firefox properly validate descriptors.
+
+        Although [[DefineOwnProperty]] failure is silently ignored by Chrome and the spec [2], WebKit now
+        throws a TypeError, which is a desired behavior for built-ins and was proven to be web-compatible
+        by Firefox. With WebKit being the second implementation that throws, the spec can be tightened.
+
+        After r264574, attributeChangeTransition() is called during defineOwnProperty(), ensuring inline
+        caching is correct. Also, this change adjusts `window.opener` setter [3].
+
+        [1] https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods
+        [2] https://heycam.github.io/webidl/#dfn-attribute-setter (step 4.5.5)
+        [3] https://html.spec.whatwg.org/multipage/browsers.html#dom-opener
+
+        Tests: fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html
+               fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html
+               fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setOpener):
+        (WebCore::JSDOMWindow::setOpenDatabase):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (AttributeSetterNeedsPropertyName):
+        (GenerateAttributeSetterBodyDefinition):
+        (GenerateAttributeSetterTrampolineDefinition):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+
 2021-07-23  Wenson Hsieh  <[email protected]>
 
         REGRESSION (r279751): WebContent process often crashes when hovering over content on apple.com

Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (280279 => 280280)


--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp	2021-07-24 01:56:31 UTC (rev 280280)
@@ -561,8 +561,9 @@
         wrapped().disownOpener();
         return;
     }
-    VM& vm = lexicalGlobalObject.vm();
-    replaceStaticPropertySlot(vm, this, Identifier::fromString(vm, "opener"), value);
+
+    bool shouldThrow = true;
+    createDataProperty(&lexicalGlobalObject, Identifier::fromString(lexicalGlobalObject.vm(), "opener"), value, shouldThrow);
 }
 
 JSValue JSDOMWindow::self(JSC::JSGlobalObject&) const
@@ -632,8 +633,8 @@
     if (!BindingSecurity::shouldAllowAccessToDOMWindow(&lexicalGlobalObject, wrapped(), ThrowSecurityError))
         return;
 
-    VM& vm = lexicalGlobalObject.vm();
-    replaceStaticPropertySlot(vm, this, Identifier::fromString(vm, "openDatabase"), value);
+    bool shouldThrow = true;
+    createDataProperty(&lexicalGlobalObject, Identifier::fromString(lexicalGlobalObject.vm(), "openDatabase"), value, shouldThrow);
 }
 
 } // namespace WebCore

Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (280279 => 280280)


--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2021-07-24 01:56:31 UTC (rev 280280)
@@ -5350,6 +5350,14 @@
     push(@$outputArray, "#endif\n\n") if $conditional;
 }
 
+sub AttributeSetterNeedsPropertyName
+{
+    my $attribute = shift;
+
+    return $codeGenerator->ExtendedAttributeContains($attribute->extendedAttributes->{CallWith}, "PropertyName")
+        || $attribute->extendedAttributes->{Replaceable};
+}
+
 sub GenerateAttributeSetterBodyDefinition
 {
     my ($outputArray, $interface, $className, $attribute, $attributeSetterBodyName, $conditional) = @_;
@@ -5358,7 +5366,7 @@
     push(@signatureArguments, "JSGlobalObject& lexicalGlobalObject");
     push(@signatureArguments, "${className}& thisObject") if !$attribute->isStatic;
     push(@signatureArguments, "JSValue value");
-    push(@signatureArguments, "PropertyName propertyName") if $codeGenerator->ExtendedAttributeContains($attribute->extendedAttributes->{CallWith}, "PropertyName");
+    push(@signatureArguments, "PropertyName propertyName") if AttributeSetterNeedsPropertyName($attribute);
 
     my $needSecurityCheck = $interface->extendedAttributes->{CheckSecurity} && !$attribute->extendedAttributes->{DoNotCheckSecurity} && !$attribute->extendedAttributes->{DoNotCheckSecurityOnSetter};
     my $hasCustomSetter = HasCustomSetter($attribute);
@@ -5410,13 +5418,14 @@
         push(@$outputArray, "    ensureStillAliveHere(value);\n\n");
         push(@$outputArray, "    return true;\n");
     } elsif ($isReplaceable) {
-        my $id = $attribute->name;
-        push(@$outputArray, "    // Shadowing a built-in property.\n");
-        if (AttributeShouldBeOnInstance($interface, $attribute)) {
-            push(@$outputArray, "    return replaceStaticPropertySlot(vm, &thisObject, Identifier::fromString(vm, reinterpret_cast<const LChar*>(\"${id}\"), strlen(\"${id}\")), value);\n");
+        if ($needThrowScope) {
+            push(@$outputArray, "    throwScope.release();\n");
         } else {
-            push(@$outputArray, "    return thisObject.putDirect(vm, Identifier::fromString(vm, reinterpret_cast<const LChar*>(\"${id}\"), strlen(\"${id}\")), value);\n");
+            push(@$outputArray, "    UNUSED_PARAM(vm);\n");
         }
+        push(@$outputArray, "    bool shouldThrow = true;\n");
+        push(@$outputArray, "    thisObject.createDataProperty(&lexicalGlobalObject, propertyName, value, shouldThrow);\n");
+        push(@$outputArray, "    return true;\n");
     } elsif ($attribute->extendedAttributes->{PutForwards}) {
         assert("[PutForwards] is not compatible with static attributes") if $attribute->isStatic;
         
@@ -5496,7 +5505,7 @@
     
     my $callAttributeSetterName = "set";
     $callAttributeSetterName .= "Static" if $attribute->isStatic;
-    $callAttributeSetterName .= "PassingPropertyName" if $codeGenerator->ExtendedAttributeContains($attribute->extendedAttributes->{CallWith}, "PropertyName");
+    $callAttributeSetterName .= "PassingPropertyName" if AttributeSetterNeedsPropertyName($attribute);
 
     my @templateParameters = ();
     push(@templateParameters, $attributeSetterBodyName);

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (280279 => 280280)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp	2021-07-24 01:43:37 UTC (rev 280279)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp	2021-07-24 01:56:31 UTC (rev 280280)
@@ -4712,16 +4712,18 @@
     return IDLAttribute<JSTestObj>::get<jsTestObj_replaceableAttributeGetter, CastedThisErrorBehavior::Assert>(*lexicalGlobalObject, thisValue, attributeName);
 }
 
-static inline bool setJSTestObj_replaceableAttributeSetter(JSGlobalObject& lexicalGlobalObject, JSTestObj& thisObject, JSValue value)
+static inline bool setJSTestObj_replaceableAttributeSetter(JSGlobalObject& lexicalGlobalObject, JSTestObj& thisObject, JSValue value, PropertyName propertyName)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    // Shadowing a built-in property.
-    return thisObject.putDirect(vm, Identifier::fromString(vm, reinterpret_cast<const LChar*>("replaceableAttribute"), strlen("replaceableAttribute")), value);
+    UNUSED_PARAM(vm);
+    bool shouldThrow = true;
+    thisObject.createDataProperty(&lexicalGlobalObject, propertyName, value, shouldThrow);
+    return true;
 }
 
 JSC_DEFINE_CUSTOM_SETTER(setJSTestObj_replaceableAttribute, (JSGlobalObject* lexicalGlobalObject, EncodedJSValue thisValue, EncodedJSValue encodedValue, PropertyName attributeName))
 {
-    return IDLAttribute<JSTestObj>::set<setJSTestObj_replaceableAttributeSetter>(*lexicalGlobalObject, thisValue, encodedValue, attributeName);
+    return IDLAttribute<JSTestObj>::setPassingPropertyName<setJSTestObj_replaceableAttributeSetter>(*lexicalGlobalObject, thisValue, encodedValue, attributeName);
 }
 
 static inline JSValue jsTestObj_nullableDoubleAttributeGetter(JSGlobalObject& lexicalGlobalObject, JSTestObj& thisObject)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to