Title: [295602] trunk
Revision
295602
Author
[email protected]
Date
2022-06-16 11:49:52 -0700 (Thu, 16 Jun 2022)

Log Message

[WebIDL] maplike<> and setlike<> declarations should be resilient to tampered prototypes
https://bugs.webkit.org/show_bug.cgi?id=241617
<rdar://93229569>

Reviewed by Yusuke Suzuki.

With this change, maplike<> and setlike<> declarations work as expected if methods of
Map.prototype / Set.prototype are removed, as they are suppossed to per spec [1][2].
Usage of backing Map / Set is an implementation detail of WebKit bindings and should
not be observable.

The fix mirrors all Map / Set prototype methods and "size" getter by private names,
which are inacessible to userland code, ensuring that public JSFunction* instances
are reused to avoid memory bloat.

Also, this change:
  * saves creating 4 extra JSFunction* instances during init of Map / Set prototypes;
  * speeds-up call forwarding by retrieving methods from prototypes with getDirect();
  * aligns property order with the spec, even though there is no requirement.

[1] https://webidl.spec.whatwg.org/#es-maplike
[2] https://webidl.spec.whatwg.org/#es-setlike

* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype.html: Added.
* Source/_javascript_Core/DerivedSources-output.xcfilelist:
* Source/_javascript_Core/DerivedSources.make:
* Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj:
* Source/_javascript_Core/builtins/BuiltinNames.h:
* Source/_javascript_Core/runtime/MapPrototype.cpp:
(JSC::MapPrototype::finishCreation):
* Source/_javascript_Core/runtime/SetPrototype.cpp:
(JSC::SetPrototype::finishCreation):
* Source/WebCore/bindings/js/JSDOMBindingInternals.js:
(forEachWrapper):
* Source/WebCore/bindings/js/JSDOMMapLike.cpp:
(WebCore::getBackingMap):
(WebCore::clearBackingMap):
(WebCore::setToBackingMap):
(WebCore::forwardFunctionCallToBackingMap):
* Source/WebCore/bindings/js/JSDOMMapLike.h:
(WebCore::forwardSizeToMapLike):
(WebCore::forwardEntriesToMapLike):
(WebCore::forwardKeysToMapLike):
(WebCore::forwardValuesToMapLike):
(WebCore::forwardClearToMapLike):
(WebCore::forwardGetToMapLike):
(WebCore::forwardHasToMapLike):
(WebCore::forwardSetToMapLike):
(WebCore::forwardDeleteToMapLike):
* Source/WebCore/bindings/js/JSDOMSetLike.cpp:
(WebCore::getBackingSet):
(WebCore::clearBackingSet):
(WebCore::addToBackingSet):
(WebCore::forwardFunctionCallToBackingSet):
* Source/WebCore/bindings/js/JSDOMSetLike.h:
(WebCore::forwardSizeToSetLike):
(WebCore::forwardEntriesToSetLike):
(WebCore::forwardKeysToSetLike):
(WebCore::forwardValuesToSetLike):
(WebCore::forwardClearToSetLike):
(WebCore::forwardHasToSetLike):
(WebCore::forwardAddToSetLike):
(WebCore::forwardDeleteToSetLike):
* Source/WebCore/bindings/js/WebCoreBuiltinNames.h:

Canonical link: https://commits.webkit.org/251607@main

Modified Paths

Added Paths

Diff

Added: trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype-expected.txt (0 => 295602)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype-expected.txt	2022-06-16 18:49:52 UTC (rev 295602)
@@ -0,0 +1,3 @@
+
+PASS Highlight is a setlike interface that works as expected even if Set.prototype is tampered.
+

Added: trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype.html (0 => 295602)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype.html	                        (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/Highlight-setlike-tampered-Set-prototype.html	2022-06-16 18:49:52 UTC (rev 295602)
@@ -0,0 +1,55 @@
+<!doctype html>
+<title>Highlight is a setlike interface that works as expected even if Set.prototype is tampered</title>
+<link rel="help" href=""
+<script src=""
+<script src=""
+
+<body>
+<script>
+"use strict";
+
+function tamperSetPrototype() {
+  delete Set.prototype.size;
+
+  Set.prototype.entries = null;
+  Set.prototype.forEach = undefined;
+  Set.prototype.has = "foo";
+  Set.prototype.keys = 0;
+  Set.prototype.values = Symbol();
+  Set.prototype[Symbol.iterator] = 1;
+  Set.prototype.add = true;
+  Set.prototype.clear = "";
+  Set.prototype.delete = -1.5;
+
+  Object.freeze(Set.prototype);
+}
+
+test(() => {
+  tamperSetPrototype();
+
+  const staticRange = new StaticRange({startContainer: document.body, endContainer: document.body, startOffset: 0, endOffset: 0});
+  const highlight = new Highlight(staticRange);
+
+  assert_equals(highlight.size, 1);
+  assert_true(highlight.has(staticRange));
+  assert_equals([...highlight.entries()][0][0], staticRange);
+
+  highlight.clear();
+  assert_equals(highlight.size, 0);
+
+  highlight.add(staticRange);
+  assert_equals(highlight.size, 1);
+
+  highlight.delete(staticRange);
+  assert_equals(highlight.size, 0);
+  assert_false(highlight.has(staticRange));
+
+  highlight.add(staticRange);
+  assert_equals([...highlight.keys()][0], staticRange);
+  assert_equals([...highlight.values()][0], staticRange);
+
+  let callbackCalled = false;
+  highlight.forEach(() => { callbackCalled = true; });
+  assert_true(callbackCalled);
+}, "Highlight is a setlike interface that works as expected even if Set.prototype is tampered.");
+</script>

Added: trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype-expected.txt (0 => 295602)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype-expected.txt	2022-06-16 18:49:52 UTC (rev 295602)
@@ -0,0 +1,3 @@
+
+PASS HighlightRegistry is a maplike interface that works as expected even if Map.prototype is tampered.
+

Added: trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype.html (0 => 295602)


--- trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype.html	                        (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-maplike-tampered-Map-prototype.html	2022-06-16 18:49:52 UTC (rev 295602)
@@ -0,0 +1,61 @@
+<!doctype html>
+<title>HighlightRegistry is a maplike interface that works as expected even if Map.prototype is tampered</title>
+<link rel="help" href=""
+<script src=""
+<script src=""
+
+<body>
+<script>
+"use strict";
+
+function tamperMapPrototype() {
+  delete Map.prototype.size;
+
+  Map.prototype.entries = null;
+  Map.prototype.forEach = undefined;
+  Map.prototype.get = "foo";
+  Map.prototype.has = 0;
+  Map.prototype.keys = Symbol();
+  Map.prototype.values = 1;
+  Map.prototype[Symbol.iterator] = true;
+  Map.prototype.clear = false;
+  Map.prototype.delete = "";
+  Map.prototype.set = 3.14;
+
+  Object.freeze(Map.prototype);
+}
+
+test(() => {
+  tamperMapPrototype();
+
+  const highlight = new Highlight(new StaticRange({startContainer: document.body, endContainer: document.body, startOffset: 0, endOffset: 0}));
+  const highlightRegister = new HighlightRegister();
+
+  assert_equals(highlightRegister.size, 0);
+  highlightRegister.set("foo", highlight);
+  assert_equals(highlightRegister.size, 1);
+
+  assert_true(highlightRegister.has("foo"));
+  assert_equals([...highlightRegister.entries()][0][0], "foo");
+
+  highlightRegister.clear();
+  assert_equals(highlightRegister.size, 0);
+  assert_equals(highlightRegister.get("foo"), undefined);
+
+  highlightRegister.set("bar", highlight);
+  assert_equals(highlightRegister.get("bar"), highlight);
+  assert_equals([...highlightRegister][0][1], highlight);
+
+  highlightRegister.delete("bar");
+  assert_equals(highlightRegister.size, 0);
+  assert_false(highlightRegister.has("bar"));
+
+  highlightRegister.set("baz", highlight);
+  assert_equals([...highlightRegister.keys()][0], "baz");
+  assert_equals([...highlightRegister.values()][0], highlight);
+
+  let callbackCalled = false;
+  highlightRegister.forEach(() => { callbackCalled = true; });
+  assert_true(callbackCalled);
+}, "HighlightRegistry is a maplike interface that works as expected even if Map.prototype is tampered.");
+</script>

Modified: trunk/Source/_javascript_Core/DerivedSources-output.xcfilelist (295601 => 295602)


--- trunk/Source/_javascript_Core/DerivedSources-output.xcfilelist	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/_javascript_Core/DerivedSources-output.xcfilelist	2022-06-16 18:49:52 UTC (rev 295602)
@@ -54,7 +54,6 @@
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/_javascript_Core_BUILTINS_DEPENDENCIES_LIST
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/KeywordLookup.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/Lexer.lut.h
-$(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/MapPrototype.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/NumberConstructor.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/NumberPrototype.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/ObjectConstructor.lut.h
@@ -61,7 +60,6 @@
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/ReflectObject.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/RegExpConstructor.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/RegExpJitTables.h
-$(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/SetPrototype.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/ShadowRealmObject.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/ShadowRealmPrototype.lut.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/_javascript_Core/StringConstructor.lut.h

Modified: trunk/Source/_javascript_Core/DerivedSources.make (295601 => 295602)


--- trunk/Source/_javascript_Core/DerivedSources.make	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/_javascript_Core/DerivedSources.make	2022-06-16 18:49:52 UTC (rev 295602)
@@ -193,13 +193,11 @@
     JSPromiseConstructor.lut.h \
     JSPromisePrototype.lut.h \
     JSWebAssembly.lut.h \
-    MapPrototype.lut.h \
     NumberConstructor.lut.h \
     NumberPrototype.lut.h \
     ObjectConstructor.lut.h \
     ReflectObject.lut.h \
     RegExpConstructor.lut.h \
-    SetPrototype.lut.h \
     ShadowRealmPrototype.lut.h \
     StringConstructor.lut.h \
     StringPrototype.lut.h \

Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (295601 => 295602)


--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2022-06-16 18:49:52 UTC (rev 295602)
@@ -4228,8 +4228,6 @@
 		7013CA8A1B491A9400CAE613 /* JSMicrotask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMicrotask.h; sourceTree = "<group>"; };
 		7035587C1C418419004BD7BF /* MapPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode._javascript_; path = MapPrototype.js; sourceTree = "<group>"; };
 		7035587D1C418419004BD7BF /* SetPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode._javascript_; path = SetPrototype.js; sourceTree = "<group>"; };
-		7035587E1C418458004BD7BF /* MapPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapPrototype.lut.h; sourceTree = "<group>"; };
-		7035587F1C418458004BD7BF /* SetPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetPrototype.lut.h; sourceTree = "<group>"; };
 		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
 		705B41A31A6E501E00716757 /* Symbol.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Symbol.cpp; sourceTree = "<group>"; };
 		705B41A41A6E501E00716757 /* Symbol.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Symbol.h; sourceTree = "<group>"; };
@@ -6029,8 +6027,8 @@
 				86A054471556451B00445157 /* LowLevelInterpreter32_64.asm */,
 				86A054481556451B00445157 /* LowLevelInterpreter64.asm */,
 				FE00262223F3AF33003A358F /* WebAssembly.asm */,
+				FEA21689285007E3002B3662 /* WebAssembly32_64.asm */,
 				FEA2168828500762002B3662 /* WebAssembly64.asm */,
-				FEA21689285007E3002B3662 /* WebAssembly32_64.asm */,
 			);
 			name = llint;
 			sourceTree = "<group>";
@@ -7309,7 +7307,6 @@
 				A7C225CD1399849C00FF1662 /* KeywordLookup.h */,
 				BC18C52D0E16FCE100B34460 /* Lexer.lut.h */,
 				70DE9A081BE7D670005D89D9 /* LLIntAssembly.h */,
-				7035587E1C418458004BD7BF /* MapPrototype.lut.h */,
 				BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */,
 				996B730D1BD9FA2C00331B84 /* NumberPrototype.lut.h */,
 				996B730E1BD9FA2C00331B84 /* ObjectConstructor.lut.h */,
@@ -7316,7 +7313,6 @@
 				996B730F1BD9FA2C00331B84 /* ReflectObject.lut.h */,
 				BCD202D50E170708002C7E82 /* RegExpConstructor.lut.h */,
 				A718F61A11754A21002465A7 /* RegExpJitTables.h */,
-				7035587F1C418458004BD7BF /* SetPrototype.lut.h */,
 				996B73111BD9FA2C00331B84 /* StringConstructor.lut.h */,
 				996B73131BD9FA2C00331B84 /* SymbolConstructor.lut.h */,
 				996B73141BD9FA2C00331B84 /* SymbolPrototype.lut.h */,
@@ -8266,7 +8262,6 @@
 				7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */,
 				7E4EE7080EBB7963005934AA /* StructureChain.h */,
 				537FEEC82742BDA300C9EFEE /* StructureID.h */,
-				2AAAA31018BD49D100394CC8 /* TypeInfoBlob.h */,
 				0FD2C92316D01EE900C7803F /* StructureInlines.h */,
 				C2F0F2D016BAEEE900187C19 /* StructureRareData.cpp */,
 				C2FE18A316BAEC4000AF3061 /* StructureRareData.h */,
@@ -8342,6 +8337,7 @@
 				0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */,
 				0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */,
 				0FB7F39115ED8E3800F167B2 /* TypeError.h */,
+				2AAAA31018BD49D100394CC8 /* TypeInfoBlob.h */,
 				52B310FE1975B4240080857C /* TypeLocationCache.cpp */,
 				52B311001975B4670080857C /* TypeLocationCache.h */,
 				0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */,
@@ -11108,7 +11104,6 @@
 				7986943B1F8C0ACC009232AE /* StructureCache.h in Headers */,
 				7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,
 				537FEEC92742BDA300C9EFEE /* StructureID.h in Headers */,
-				2AAAA31218BD49D100394CC8 /* TypeInfoBlob.h in Headers */,
 				0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,
 				C2FE18A416BAEC4000AF3061 /* StructureRareData.h in Headers */,
 				C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */,
@@ -11176,6 +11171,7 @@
 				0F2B670917B6B5AB00A7AE3F /* TypedArrays.h in Headers */,
 				0F2B670B17B6B5AB00A7AE3F /* TypedArrayType.h in Headers */,
 				0FB7F39D15ED8E4600F167B2 /* TypeError.h in Headers */,
+				2AAAA31218BD49D100394CC8 /* TypeInfoBlob.h in Headers */,
 				0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */,
 				52B311011975B4670080857C /* TypeLocationCache.h in Headers */,
 				0FFB6C391AF48DDC00DB1BF7 /* TypeofType.h in Headers */,

Modified: trunk/Source/_javascript_Core/builtins/BuiltinNames.h (295601 => 295602)


--- trunk/Source/_javascript_Core/builtins/BuiltinNames.h	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/_javascript_Core/builtins/BuiltinNames.h	2022-06-16 18:49:52 UTC (rev 295602)
@@ -92,6 +92,9 @@
     macro(values) \
     macro(get) \
     macro(set) \
+    macro(clear) \
+    macro(delete) \
+    macro(size) \
     macro(shift) \
     macro(Int8Array) \
     macro(Int16Array) \

Modified: trunk/Source/_javascript_Core/runtime/MapPrototype.cpp (295601 => 295602)


--- trunk/Source/_javascript_Core/runtime/MapPrototype.cpp	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/_javascript_Core/runtime/MapPrototype.cpp	2022-06-16 18:49:52 UTC (rev 295602)
@@ -27,22 +27,15 @@
 #include "MapPrototype.h"
 
 #include "BuiltinNames.h"
+#include "GetterSetter.h"
 #include "JSCInlines.h"
 #include "JSMapInlines.h"
 #include "JSMapIterator.h"
 
-#include "MapPrototype.lut.h"
-
 namespace JSC {
 
-const ClassInfo MapPrototype::s_info = { "Map"_s, &Base::s_info, &mapPrototypeTable, nullptr, CREATE_METHOD_TABLE(MapPrototype) };
+const ClassInfo MapPrototype::s_info = { "Map"_s, &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(MapPrototype) };
 
-/* Source for MapPrototype.lut.h
-@begin mapPrototypeTable
-  forEach   JSBuiltin  DontEnum|Function 0
-@end
-*/
-
 static JSC_DECLARE_HOST_FUNCTION(mapProtoFuncClear);
 static JSC_DECLARE_HOST_FUNCTION(mapProtoFuncDelete);
 static JSC_DECLARE_HOST_FUNCTION(mapProtoFuncGet);
@@ -59,25 +52,50 @@
     Base::finishCreation(vm);
     ASSERT(inherits(info()));
 
-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, mapProtoFuncClear, static_cast<unsigned>(PropertyAttribute::DontEnum), 0);
-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, mapProtoFuncDelete, static_cast<unsigned>(PropertyAttribute::DontEnum), 1);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSMapGetIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSMapHasIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, mapProtoFuncSet, static_cast<unsigned>(PropertyAttribute::DontEnum), 2, JSMapSetIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), mapProtoFuncKeys, static_cast<unsigned>(PropertyAttribute::DontEnum), 0, JSMapKeysIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().valuesPublicName(), mapProtoFuncValues, static_cast<unsigned>(PropertyAttribute::DontEnum), 0, JSMapValuesIntrinsic);
+    JSFunction* clearFunc = JSFunction::create(vm, globalObject, 0, vm.propertyNames->clear.string(), mapProtoFuncClear);
+    putDirectWithoutTransition(vm, vm.propertyNames->clear, clearFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().clearPrivateName(), clearFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
 
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSMapGetIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().setPrivateName(), mapProtoFuncSet, static_cast<unsigned>(PropertyAttribute::DontEnum), 2, JSMapSetIntrinsic);
+    JSFunction* deleteFunc = JSFunction::create(vm, globalObject, 1, vm.propertyNames->deleteKeyword.string(), mapProtoFuncDelete);
+    putDirectWithoutTransition(vm, vm.propertyNames->deleteKeyword, deleteFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().deletePrivateName(), deleteFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
 
     JSFunction* entries = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().entriesPublicName().string(), mapProtoFuncEntries, JSMapEntriesIntrinsic);
     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPublicName(), entries, static_cast<unsigned>(PropertyAttribute::DontEnum));
     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPrivateName(), entries, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* forEachFunc = JSFunction::create(vm, mapPrototypeForEachCodeGenerator(vm), globalObject);
+    putDirectWithoutTransition(vm, vm.propertyNames->forEach, forEachFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().forEachPrivateName(), forEachFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* getFunc = JSFunction::create(vm, globalObject, 1, vm.propertyNames->get.string(), mapProtoFuncGet, JSMapGetIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->get, getFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().getPrivateName(), getFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* hasFunc = JSFunction::create(vm, globalObject, 1, vm.propertyNames->has.string(), mapProtoFuncHas, JSMapHasIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->has, hasFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().hasPrivateName(), hasFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* keysFunc = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().keysPublicName().string(), mapProtoFuncKeys, JSMapKeysIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPublicName(), keysFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPrivateName(), keysFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* setFunc = JSFunction::create(vm, globalObject, 2, vm.propertyNames->set.string(), mapProtoFuncSet, JSMapSetIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->set, setFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().setPrivateName(), setFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* sizeGetter = JSFunction::create(vm, globalObject, 0, "get size"_s, mapProtoFuncSize);
+    GetterSetter* sizeAccessor = GetterSetter::create(vm, globalObject, sizeGetter, nullptr);
+    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->size, sizeAccessor, PropertyAttribute::DontEnum | PropertyAttribute::Accessor);
+    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->builtinNames().sizePrivateName(), sizeAccessor, PropertyAttribute::DontEnum | PropertyAttribute::Accessor);
+
+    JSFunction* valuesFunc = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().valuesPublicName().string(), mapProtoFuncValues, JSMapValuesIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPublicName(), valuesFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPrivateName(), valuesFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
     putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, entries, static_cast<unsigned>(PropertyAttribute::DontEnum));
     JSC_TO_STRING_TAG_WITHOUT_TRANSITION();
 
-    JSC_NATIVE_GETTER_WITHOUT_TRANSITION(vm.propertyNames->size, mapProtoFuncSize, PropertyAttribute::DontEnum | PropertyAttribute::Accessor);
-
     globalObject->installMapPrototypeWatchpoint(this);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/SetPrototype.cpp (295601 => 295602)


--- trunk/Source/_javascript_Core/runtime/SetPrototype.cpp	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/_javascript_Core/runtime/SetPrototype.cpp	2022-06-16 18:49:52 UTC (rev 295602)
@@ -27,23 +27,16 @@
 #include "SetPrototype.h"
 
 #include "BuiltinNames.h"
+#include "GetterSetter.h"
 #include "HashMapImplInlines.h"
 #include "JSCInlines.h"
 #include "JSSet.h"
 #include "JSSetIterator.h"
 
-#include "SetPrototype.lut.h"
-
 namespace JSC {
 
-const ClassInfo SetPrototype::s_info = { "Set"_s, &Base::s_info, &setPrototypeTable, nullptr, CREATE_METHOD_TABLE(SetPrototype) };
+const ClassInfo SetPrototype::s_info = { "Set"_s, &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(SetPrototype) };
 
-/* Source for SetIteratorPrototype.lut.h
-@begin setPrototypeTable
-  forEach   JSBuiltin  DontEnum|Function 0
-@end
-*/
-
 static JSC_DECLARE_HOST_FUNCTION(setProtoFuncAdd);
 static JSC_DECLARE_HOST_FUNCTION(setProtoFuncClear);
 static JSC_DECLARE_HOST_FUNCTION(setProtoFuncDelete);
@@ -58,23 +51,45 @@
     Base::finishCreation(vm);
     ASSERT(inherits(info()));
 
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->add, setProtoFuncAdd, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSSetAddIntrinsic);
-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, setProtoFuncClear, static_cast<unsigned>(PropertyAttribute::DontEnum), 0);
-    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, setProtoFuncDelete, static_cast<unsigned>(PropertyAttribute::DontEnum), 1);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSSetHasIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), setProtoFuncEntries, static_cast<unsigned>(PropertyAttribute::DontEnum), 0, JSSetEntriesIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().hasPrivateName(), setProtoFuncHas, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSSetHasIntrinsic);
-    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().addPrivateName(), setProtoFuncAdd, static_cast<unsigned>(PropertyAttribute::DontEnum), 1, JSSetAddIntrinsic);
+    JSFunction* addFunc = JSFunction::create(vm, globalObject, 1, vm.propertyNames->add.string(), setProtoFuncAdd, JSSetAddIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->add, addFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().addPrivateName(), addFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
 
+    JSFunction* clearFunc = JSFunction::create(vm, globalObject, 0, vm.propertyNames->clear.string(), setProtoFuncClear);
+    putDirectWithoutTransition(vm, vm.propertyNames->clear, clearFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().clearPrivateName(), clearFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* deleteFunc = JSFunction::create(vm, globalObject, 1, vm.propertyNames->deleteKeyword.string(), setProtoFuncDelete);
+    putDirectWithoutTransition(vm, vm.propertyNames->deleteKeyword, deleteFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().deletePrivateName(), deleteFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* entriesFunc = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().entriesPublicName().string(), setProtoFuncEntries, JSSetEntriesIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPublicName(), entriesFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPrivateName(), entriesFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* forEachFunc = JSFunction::create(vm, setPrototypeForEachCodeGenerator(vm), globalObject);
+    putDirectWithoutTransition(vm, vm.propertyNames->forEach, forEachFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().forEachPrivateName(), forEachFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* hasFunc = JSFunction::create(vm, globalObject, 1, vm.propertyNames->has.string(), setProtoFuncHas, JSSetHasIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->has, hasFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().hasPrivateName(), hasFunc, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
     JSFunction* values = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().valuesPublicName().string(), setProtoFuncValues, JSSetValuesIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPublicName(), values, static_cast<unsigned>(PropertyAttribute::DontEnum));
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPrivateName(), values, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
+    JSFunction* sizeGetter = JSFunction::create(vm, globalObject, 0, "get size"_s, setProtoFuncSize);
+    GetterSetter* sizeAccessor = GetterSetter::create(vm, globalObject, sizeGetter, nullptr);
+    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->size, sizeAccessor, PropertyAttribute::DontEnum | PropertyAttribute::Accessor);
+    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->builtinNames().sizePrivateName(), sizeAccessor, PropertyAttribute::DontEnum | PropertyAttribute::Accessor);
+
     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPublicName(), values, static_cast<unsigned>(PropertyAttribute::DontEnum));
     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPrivateName(), values, static_cast<unsigned>(PropertyAttribute::DontEnum));
-    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPublicName(), values, static_cast<unsigned>(PropertyAttribute::DontEnum));
+
     putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, values, static_cast<unsigned>(PropertyAttribute::DontEnum));
     JSC_TO_STRING_TAG_WITHOUT_TRANSITION();
 
-    JSC_NATIVE_GETTER_WITHOUT_TRANSITION(vm.propertyNames->size, setProtoFuncSize, PropertyAttribute::DontEnum | PropertyAttribute::Accessor);
-
     globalObject->installSetPrototypeWatchpoint(this);
 }
 

Modified: trunk/Source/WebCore/bindings/js/JSDOMBindingInternals.js (295601 => 295602)


--- trunk/Source/WebCore/bindings/js/JSDOMBindingInternals.js	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/WebCore/bindings/js/JSDOMBindingInternals.js	2022-06-16 18:49:52 UTC (rev 295602)
@@ -25,10 +25,10 @@
 
 // @internal
 
-function forEachWrapper(mapLikeOrSetLike, callback)
+function forEachWrapper(backingMapOrSet, callback)
 {
     "use strict";
-    mapLikeOrSetLike.forEach((value, key, backingMapOrSet) => {
+    backingMapOrSet.@forEach((value, key) => {
         callback(value, key, this);
     });
 }

Modified: trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp (295601 => 295602)


--- trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp	2022-06-16 18:49:52 UTC (rev 295602)
@@ -37,8 +37,8 @@
 std::pair<bool, std::reference_wrapper<JSC::JSObject>> getBackingMap(JSC::JSGlobalObject& lexicalGlobalObject, JSC::JSObject& mapLike)
 {
     auto& vm = lexicalGlobalObject.vm();
-    auto backingMap = mapLike.get(&lexicalGlobalObject, builtinNames(vm).backingMapPrivateName());
-    if (!backingMap.isUndefined())
+    auto backingMap = mapLike.getDirect(vm, builtinNames(vm).backingMapPrivateName());
+    if (backingMap)
         return { false, *JSC::asObject(backingMap) };
 
     JSC::DeferTerminationForAWhile deferScope(vm);
@@ -54,11 +54,11 @@
 void clearBackingMap(JSC::JSGlobalObject& lexicalGlobalObject, JSC::JSObject& backingMap)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    auto function = backingMap.get(&lexicalGlobalObject, vm.propertyNames->clear);
+    auto function = lexicalGlobalObject.mapPrototype()->getDirect(vm, vm.propertyNames->builtinNames().clearPrivateName());
+    ASSERT(function);
 
     auto callData = JSC::getCallData(function);
-    if (callData.type == JSC::CallData::Type::None)
-        return;
+    ASSERT(callData.type != JSC::CallData::Type::None);
 
     JSC::MarkedArgumentBuffer arguments;
     JSC::call(&lexicalGlobalObject, function, callData, &backingMap, arguments);
@@ -67,11 +67,11 @@
 void setToBackingMap(JSC::JSGlobalObject& lexicalGlobalObject, JSC::JSObject& backingMap, JSC::JSValue key, JSC::JSValue value)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    auto function = backingMap.get(&lexicalGlobalObject, vm.propertyNames->set);
+    auto function = lexicalGlobalObject.mapPrototype()->getDirect(vm, vm.propertyNames->builtinNames().setPrivateName());
+    ASSERT(function);
 
     auto callData = JSC::getCallData(function);
-    if (callData.type == JSC::CallData::Type::None)
-        return;
+    ASSERT(callData.type != JSC::CallData::Type::None);
 
     JSC::MarkedArgumentBuffer arguments;
     arguments.append(key);
@@ -86,11 +86,12 @@
 
 JSC::JSValue forwardFunctionCallToBackingMap(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, JSC::JSObject& backingMap, const JSC::Identifier& functionName)
 {
-    auto function = backingMap.get(&lexicalGlobalObject, functionName);
+    auto& vm = JSC::getVM(&lexicalGlobalObject);
+    auto function = lexicalGlobalObject.mapPrototype()->getDirect(vm, functionName);
+    ASSERT(function);
 
     auto callData = JSC::getCallData(function);
-    if (callData.type == JSC::CallData::Type::None)
-        return JSC::jsUndefined();
+    ASSERT(callData.type != JSC::CallData::Type::None);
 
     JSC::MarkedArgumentBuffer arguments;
     for (size_t cptr = 0; cptr < callFrame.argumentCount(); ++cptr)

Modified: trunk/Source/WebCore/bindings/js/JSDOMMapLike.h (295601 => 295602)


--- trunk/Source/WebCore/bindings/js/JSDOMMapLike.h	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/WebCore/bindings/js/JSDOMMapLike.h	2022-06-16 18:49:52 UTC (rev 295602)
@@ -32,6 +32,9 @@
 
 namespace WebCore {
 
+// FIXME: Optimize / rework maplike<> and setlike<> declarations.
+// A few ideas in https://bugs.webkit.org/show_bug.cgi?id=241639.
+
 WEBCORE_EXPORT std::pair<bool, std::reference_wrapper<JSC::JSObject>> getBackingMap(JSC::JSGlobalObject&, JSC::JSObject& mapLike);
 WEBCORE_EXPORT JSC::JSValue forwardAttributeGetterToBackingMap(JSC::JSGlobalObject&, JSC::JSObject&, const JSC::Identifier&);
 WEBCORE_EXPORT JSC::JSValue forwardFunctionCallToBackingMap(JSC::JSGlobalObject&, JSC::CallFrame&, JSC::JSObject&, const JSC::Identifier&);
@@ -89,25 +92,25 @@
 template<typename WrapperClass> JSC::JSValue forwardSizeToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, WrapperClass& mapLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardAttributeGetterToBackingMap(lexicalGlobalObject, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->size);
+    return forwardAttributeGetterToBackingMap(lexicalGlobalObject, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().sizePrivateName());
 }
 
 template<typename WrapperClass> JSC::JSValue forwardEntriesToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().entriesPublicName());
+    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().entriesPrivateName());
 }
 
 template<typename WrapperClass> JSC::JSValue forwardKeysToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().keysPublicName());
+    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().keysPrivateName());
 }
 
 template<typename WrapperClass> JSC::JSValue forwardValuesToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().valuesPublicName());
+    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().valuesPrivateName());
 }
 
 template<typename WrapperClass> JSC::JSValue forwardClearToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike)
@@ -114,7 +117,7 @@
 {
     mapLike.wrapped().clear();
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->clear);
+    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().clearPrivateName());
 }
 
 template<typename WrapperClass, typename Callback> JSC::JSValue forwardForEachToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike, Callback&&)
@@ -126,13 +129,13 @@
 template<typename WrapperClass, typename ItemType> JSC::JSValue forwardGetToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike, ItemType&&)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().getPublicName());
+    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().getPrivateName());
 }
 
 template<typename WrapperClass, typename ItemType> JSC::JSValue forwardHasToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike, ItemType&&)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().hasPublicName());
+    return forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().hasPrivateName());
 }
 
 template<typename WrapperClass, typename KeyType, typename ValueType> JSC::JSValue forwardSetToMapLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& mapLike, KeyType&& key, ValueType&& value)
@@ -139,7 +142,7 @@
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
     mapLike.wrapped().setFromMapLike(std::forward<KeyType>(key), std::forward<ValueType>(value));
-    forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->set);
+    forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, getAndInitializeBackingMap(lexicalGlobalObject, mapLike), vm.propertyNames->builtinNames().setPrivateName());
     return &mapLike;
 }
 
@@ -151,7 +154,7 @@
     auto isDeleted = mapLike.wrapped().remove(std::forward<ItemType>(item));
     UNUSED_PARAM(isDeleted);
 
-    auto result = forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, backingMap, vm.propertyNames->deleteKeyword);
+    auto result = forwardFunctionCallToBackingMap(lexicalGlobalObject, callFrame, backingMap, vm.propertyNames->builtinNames().deletePrivateName());
 
     ASSERT_UNUSED(result, result.asBoolean() == isDeleted);
     return result;

Modified: trunk/Source/WebCore/bindings/js/JSDOMSetLike.cpp (295601 => 295602)


--- trunk/Source/WebCore/bindings/js/JSDOMSetLike.cpp	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/WebCore/bindings/js/JSDOMSetLike.cpp	2022-06-16 18:49:52 UTC (rev 295602)
@@ -42,8 +42,8 @@
 std::pair<bool, std::reference_wrapper<JSC::JSObject>> getBackingSet(JSC::JSGlobalObject& lexicalGlobalObject, JSC::JSObject& setLike)
 {
     auto& vm = lexicalGlobalObject.vm();
-    auto backingSet = setLike.get(&lexicalGlobalObject, builtinNames(vm).backingSetPrivateName());
-    if (backingSet.isUndefined()) {
+    auto backingSet = setLike.getDirect(vm, builtinNames(vm).backingSetPrivateName());
+    if (!backingSet) {
         auto& vm = lexicalGlobalObject.vm();
         JSC::DeferTermination deferScope(vm);
         auto scope = DECLARE_CATCH_SCOPE(vm);
@@ -60,8 +60,8 @@
 void clearBackingSet(JSC::JSGlobalObject& lexicalGlobalObject, JSC::JSObject& backingSet)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    JSC::JSValue function = backingSet.get(&lexicalGlobalObject, vm.propertyNames->clear);
-    ASSERT(!function.isUndefined());
+    auto function = lexicalGlobalObject.jsSetPrototype()->getDirect(vm, vm.propertyNames->builtinNames().clearPrivateName());
+    ASSERT(function);
 
     auto callData = JSC::getCallData(function);
     ASSERT(callData.type != JSC::CallData::Type::None);
@@ -72,8 +72,8 @@
 void addToBackingSet(JSC::JSGlobalObject& lexicalGlobalObject, JSC::JSObject& backingSet, JSC::JSValue item)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    JSC::JSValue function = backingSet.get(&lexicalGlobalObject, vm.propertyNames->add);
-    ASSERT(!function.isUndefined());
+    auto function = lexicalGlobalObject.jsSetPrototype()->getDirect(vm, vm.propertyNames->builtinNames().addPrivateName());
+    ASSERT(function);
 
     auto callData = JSC::getCallData(function);
     ASSERT(callData.type != JSC::CallData::Type::None);
@@ -89,8 +89,9 @@
 
 JSC::JSValue forwardFunctionCallToBackingSet(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, JSC::JSObject& backingSet, const JSC::Identifier& functionName)
 {
-    JSC::JSValue function = backingSet.get(&lexicalGlobalObject, functionName);
-    ASSERT(!function.isUndefined());
+    auto& vm = JSC::getVM(&lexicalGlobalObject);
+    auto function = lexicalGlobalObject.jsSetPrototype()->getDirect(vm, functionName);
+    ASSERT(function);
 
     auto callData = JSC::getCallData(function);
     ASSERT(callData.type != JSC::CallData::Type::None);

Modified: trunk/Source/WebCore/bindings/js/JSDOMSetLike.h (295601 => 295602)


--- trunk/Source/WebCore/bindings/js/JSDOMSetLike.h	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/WebCore/bindings/js/JSDOMSetLike.h	2022-06-16 18:49:52 UTC (rev 295602)
@@ -33,6 +33,9 @@
 
 namespace WebCore {
 
+// FIXME: Optimize / rework maplike<> and setlike<> declarations.
+// A few ideas in https://bugs.webkit.org/show_bug.cgi?id=241639.
+
 WEBCORE_EXPORT std::pair<bool, std::reference_wrapper<JSC::JSObject>> getBackingSet(JSC::JSGlobalObject&, JSC::JSObject& setLike);
 WEBCORE_EXPORT JSC::JSValue forwardForEachCallToBackingSet(JSDOMGlobalObject&, JSC::CallFrame&, JSC::JSObject& setLike);
 WEBCORE_EXPORT JSC::JSValue forwardAttributeGetterToBackingSet(JSC::JSGlobalObject&, JSC::JSObject&, const JSC::Identifier&);
@@ -92,7 +95,7 @@
 JSC::JSValue forwardSizeToSetLike(JSC::JSGlobalObject& lexicalGlobalObject, WrapperClass& setLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardAttributeGetterToBackingSet(lexicalGlobalObject, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->size);
+    return forwardAttributeGetterToBackingSet(lexicalGlobalObject, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().sizePrivateName());
 }
 
 template<typename WrapperClass>
@@ -99,7 +102,7 @@
 JSC::JSValue forwardEntriesToSetLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& setLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().entriesPublicName());
+    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().entriesPrivateName());
 }
 
 template<typename WrapperClass>
@@ -106,7 +109,7 @@
 JSC::JSValue forwardKeysToSetLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& setLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().keysPublicName());
+    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().keysPrivateName());
 }
 
 template<typename WrapperClass>
@@ -113,7 +116,7 @@
 JSC::JSValue forwardValuesToSetLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& setLike)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().valuesPublicName());
+    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().valuesPrivateName());
 }
 
 template<typename WrapperClass, typename Callback>
@@ -129,7 +132,7 @@
     setLike.wrapped().clearFromSetLike();
 
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->clear);
+    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().clearPrivateName());
 }
 
 template<typename WrapperClass, typename ItemType>
@@ -136,7 +139,7 @@
 JSC::JSValue forwardHasToSetLike(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, WrapperClass& setLike, ItemType&&)
 {
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().hasPublicName());
+    return forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().hasPrivateName());
 }
 
 template<typename WrapperClass, typename ItemType>
@@ -145,7 +148,7 @@
     setLike.wrapped().addToSetLike(std::forward<ItemType>(item));
 
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->add);
+    forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().addPrivateName());
     return &setLike;
 }
 
@@ -156,7 +159,7 @@
     UNUSED_PARAM(isDeleted);
 
     auto& vm = JSC::getVM(&lexicalGlobalObject);
-    auto result = forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->deleteKeyword);
+    auto result = forwardFunctionCallToBackingSet(lexicalGlobalObject, callFrame, getAndInitializeBackingSet(lexicalGlobalObject, setLike), vm.propertyNames->builtinNames().deletePrivateName());
     ASSERT_UNUSED(result, result.asBoolean() == isDeleted);
     return result;
 }

Modified: trunk/Source/WebCore/bindings/js/WebCoreBuiltinNames.h (295601 => 295602)


--- trunk/Source/WebCore/bindings/js/WebCoreBuiltinNames.h	2022-06-16 18:26:54 UTC (rev 295601)
+++ trunk/Source/WebCore/bindings/js/WebCoreBuiltinNames.h	2022-06-16 18:49:52 UTC (rev 295602)
@@ -573,7 +573,6 @@
     macro(setBodyFromInputRequest) \
     macro(setStatus) \
     macro(showModalDialog) \
-    macro(size) \
     macro(start) \
     macro(startConsumingStream) \
     macro(started) \
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to