Changeset 194399 in webkit

Timestamp:

Dec 23, 2015, 3:31:44 PM (11 years ago)

Author:

Brent Fulgham

Message:

Source/WebCore:
Avoids stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
​https://bugs.webkit.org/show_bug.cgi?id=149179
<rdar://problem/22708019>.

Patch by Pranjal Jumde <​pjumde@apple.com> on 2015-12-23
Reviewed by Filip Pizlo.

• runtime/JSObject.cpp:

(JSStorage::deletePropertyByIndex was invoking Base::deleteProperty for indexed propertyNames instead of Base::deletePropertyByIndex leading to a stack recursion)

LayoutTests:
Test to check for stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
​https://bugs.webkit.org/show_bug.cgi?id=149179
<rdar://problem/22708019>.

Patch by Pranjal Jumde <​pjumde@apple.com> on 2015-12-23
Reviewed by Filip Pizlo.

• storage/domstorage/localstorage/delete-defineproperty-removal-expected.txt: Added.
• storage/domstorage/localstorage/delete-defineproperty-removal.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/storage/domstorage/localstorage/delete-defineproperty-removal-expected.txt (added)
• LayoutTests/storage/domstorage/localstorage/delete-defineproperty-removal.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSStorageCustom.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2015-12-23  Pranjal Jumde  <pjumde@apple.com>
+
+        Test to check for stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
+        https://bugs.webkit.org/show_bug.cgi?id=149179
+        <rdar://problem/22708019>.
+
+        Reviewed by Filip Pizlo.
+
+        * storage/domstorage/localstorage/delete-defineproperty-removal-expected.txt: Added.
+        * storage/domstorage/localstorage/delete-defineproperty-removal.html: Added.
+
 2015-12-23  Eric Carlson  <eric.carlson@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-12-23  Pranjal Jumde  <pjumde@apple.com>
+
+        Avoids stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
+        https://bugs.webkit.org/show_bug.cgi?id=149179
+        <rdar://problem/22708019>.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSObject.cpp:
+        (JSStorage::deletePropertyByIndex was invoking Base::deleteProperty for indexed propertyNames instead of Base::deletePropertyByIndex leading to a stack recursion)
+
 2015-12-23  Eric Carlson  <eric.carlson@apple.com>
 

trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp

@@ -59 +59 @@
     // the native property slots manually.
     PropertySlot slot(thisObject);
-    if (getStaticValueSlot<JSStorage, Base>(exec, *s_info.staticPropHashTable, thisObject, propertyName, slot))
+    if (getStaticValueSlot<JSStorage, Base>(exec, *s_info.staticPropHashTable, thisObject, propertyName, slot)) {
+        if (Optional<uint32_t> index = parseIndex(propertyName))
+            return Base::deletePropertyByIndex(thisObject, exec, index.value());
         return Base::deleteProperty(thisObject, exec, propertyName);
-
+    }
     JSValue prototype = thisObject->prototype();
     if (prototype.isObject() && asObject(prototype)->getPropertySlot(exec, propertyName, slot))
@@ -77 +79 @@
 bool JSStorage::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned propertyName)
 {
+    JSStorage* thisObject = jsCast<JSStorage*>(cell);
+    PropertySlot slot(thisObject);
+    if (getStaticValueSlot<JSStorage, Base>(exec, *s_info.staticPropHashTable, thisObject, Identifier::from(exec, propertyName), slot))
+        return Base::deletePropertyByIndex(thisObject, exec, propertyName);
     return deleteProperty(cell, exec, Identifier::from(exec, propertyName));
 }