Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 536ac3a29fccd9f597f47ed43377a4ad70f22ba2
https://github.com/WebKit/WebKit/commit/536ac3a29fccd9f597f47ed43377a4ad70f22ba2
Author: Alexey Shvayka <[email protected]>
Date: 2024-08-06 (Tue, 06 Aug 2024)
Changed paths:
A JSTests/stress/regress-125602977.js
M Source/JavaScriptCore/runtime/CommonSlowPaths.h
Log Message:
-----------
[JSC] putDirectWithReify() should not cache putting `prototype` to a
JSFunction
https://bugs.webkit.org/show_bug.cgi?id=273580
<rdar://125602977>
Reviewed by Yusuke Suzuki.
Before this change, putDirectWithReify() used for direct op_put_by_id could
still cache putting of
`prototype` properties. Leveraging the cache, one could put a configurable
`prototype` property onto
a JSFunction with mayHaveNonReifiedPrototype() returning true. And because of
configurability, it could
have been turned into a GetterSetter and leaked via getDirect() in
JSFunction::getOwnPropertySlot(),
breaking the method's assumption that the `prototype` a JSFunction with thruthy
mayHaveNonReifiedPrototype()
must be a value.
This change prevents put slot from being cached, and clears FunctionRareData
like it's done in other
methods that put `prototype` property.
* JSTests/stress/regress-125602977.js: Added.
* Source/JavaScriptCore/runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::putDirectWithReify):
(JSC::CommonSlowPaths::putDirectAccessorWithReify):
Originally-landed-as: 272448.1012@safari-7618-branch (283802946dcc).
rdar://133089383
Canonical link: https://commits.webkit.org/281897@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
