Title: [282805] trunk
Revision
282805
Author
[email protected]
Date
2021-09-21 00:48:22 -0700 (Tue, 21 Sep 2021)

Log Message

Maplike infrastructure ASSERT()s if the first operation is a delete of a existing values
https://bugs.webkit.org/show_bug.cgi?id=230530

Reviewed by Youenn Fablet.

Source/WebCore:

The infrastructure deletes the value from the backing map before the JS map is initialized.
Then, when the infrastructure goes to delete it from the JS map, it isn't present. The
ASSERT() checks to see that it was deleted from the JS map iff it was deleted from the backing
map.

Test: js/dom/maplike.html

* bindings/js/JSDOMMapLike.h:
(WebCore::forwardDeleteToMapLike):

LayoutTests:

* js/dom/maplike.html:

Modified Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (282804 => 282805)


--- trunk/LayoutTests/ChangeLog	2021-09-21 07:26:24 UTC (rev 282804)
+++ trunk/LayoutTests/ChangeLog	2021-09-21 07:48:22 UTC (rev 282805)
@@ -1,3 +1,12 @@
+2021-09-21  Myles C. Maxfield  <[email protected]>
+
+        Maplike infrastructure ASSERT()s if the first operation is a delete of a existing values
+        https://bugs.webkit.org/show_bug.cgi?id=230530
+
+        Reviewed by Youenn Fablet.
+
+        * js/dom/maplike.html:
+
 2021-09-21  Youenn Fablet  <[email protected]>
 
         Update list of WebRTC senders and receivers when updating local or remote descriptions

Modified: trunk/LayoutTests/js/dom/maplike.html (282804 => 282805)


--- trunk/LayoutTests/js/dom/maplike.html	2021-09-21 07:26:24 UTC (rev 282804)
+++ trunk/LayoutTests/js/dom/maplike.html	2021-09-21 07:48:22 UTC (rev 282805)
@@ -9,6 +9,9 @@
 test(() => {
     assert_true(!!window.internals);
     const maplike = internals.createInternalsMapLike();
+    maplike.delete("init");
+    maplike.set("init", 0);
+
     assert_array_equals(maplike.inspectKeys(), ["init"], "init keys");
     assert_array_equals(maplike.inspectValues(), [0], "init values");
     assert_true(maplike.has("init"));

Modified: trunk/Source/WebCore/ChangeLog (282804 => 282805)


--- trunk/Source/WebCore/ChangeLog	2021-09-21 07:26:24 UTC (rev 282804)
+++ trunk/Source/WebCore/ChangeLog	2021-09-21 07:48:22 UTC (rev 282805)
@@ -1,3 +1,20 @@
+2021-09-21  Myles C. Maxfield  <[email protected]>
+
+        Maplike infrastructure ASSERT()s if the first operation is a delete of a existing values
+        https://bugs.webkit.org/show_bug.cgi?id=230530
+
+        Reviewed by Youenn Fablet.
+
+        The infrastructure deletes the value from the backing map before the JS map is initialized.
+        Then, when the infrastructure goes to delete it from the JS map, it isn't present. The
+        ASSERT() checks to see that it was deleted from the JS map iff it was deleted from the backing
+        map.
+
+        Test: js/dom/maplike.html
+
+        * bindings/js/JSDOMMapLike.h:
+        (WebCore::forwardDeleteToMapLike):
+
 2021-09-21  Ziran Sun  <[email protected]>
 
         [css-grid] When the max is less than the min in minmax(), the max will be floored by the min

Modified: trunk/Source/WebCore/bindings/js/JSDOMMapLike.h (282804 => 282805)


--- trunk/Source/WebCore/bindings/js/JSDOMMapLike.h	2021-09-21 07:26:24 UTC (rev 282804)
+++ trunk/Source/WebCore/bindings/js/JSDOMMapLike.h	2021-09-21 07:48:22 UTC (rev 282805)
@@ -145,11 +145,13 @@
 
 template<typename WrapperClass, typename ItemType> JSC::JSValue forwardDeleteToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike, ItemType&& item)
 {
+    auto& vm = JSC::getVM(&lexicalGlobalObject);
+    auto& backingMap = getAndInitializeBackingMap(lexicalGlobalObject, mapLike);
+
     auto isDeleted = mapLike.wrapped().remove(std::forward<ItemType>(item));
     UNUSED_PARAM(isDeleted);
 
-    auto& vm = JSC::getVM(&lexicalGlobalObject);
-    auto result = forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->deleteKeyword);
+    auto result = forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, backingMap, vm.propertyNames->deleteKeyword);
 
     ASSERT_UNUSED(result, result.asBoolean() == isDeleted);
     return result;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to