Changeset 204166 in webkit


Ignore:
Timestamp:
Aug 5, 2016, 4:25:28 AM (9 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r203935.
​https://bugs.webkit.org/show_bug.cgi?id=160596

looks like a 1-2% PLUM regression on iPhone 6s (Requested by
kling_ on #webkit).

Reverted changeset:

"Window's named properties should be exposed on a
WindowProperties object in its prototype"
​https://bugs.webkit.org/show_bug.cgi?id=160354
​http://trac.webkit.org/changeset/203935

Location:
trunk
Files:
2 deleted
15 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r204165 r204166  
     12016-08-05  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r203935.
     4        https://bugs.webkit.org/show_bug.cgi?id=160596
     5
     6        looks like a 1-2% PLUM regression on iPhone 6s (Requested by
     7        kling_ on #webkit).
     8
     9        Reverted changeset:
     10
     11        "Window's named properties should be exposed on a
     12        WindowProperties object in its prototype"
     13        https://bugs.webkit.org/show_bug.cgi?id=160354
     14        http://trac.webkit.org/changeset/203935
     15
    1162016-08-05  Youenn Fablet  <youenn@apple.com>
    217

  • trunk/LayoutTests/fast/dom/Window/es52-globals-expected.txt

    r203935 r204166  
    22PASS window.hasOwnProperty("x") is true
    33PASS window.hasOwnProperty("y") is false
    4 PASS window.hasOwnProperty("f") is false
    5 PASS window.__proto__.__proto__.hasOwnProperty("f") is true
    6 PASS window.hasOwnProperty("div") is false
    7 PASS window.__proto__.__proto__.hasOwnProperty("div") is true
    8 PASS window.hasOwnProperty("a") is false
     4PASS window.hasOwnProperty("f") is true
     5PASS window.hasOwnProperty("div") is true
     6FAIL window.hasOwnProperty("a") should be true. Was false.
    97PASS Element is not undefined
    108PASS x is 1

  • trunk/LayoutTests/fast/dom/Window/es52-globals.html

    r203935 r204166  
    1515shouldBeTrue('window.hasOwnProperty("x")');
    1616shouldBeFalse('window.hasOwnProperty("y")');
    17 shouldBeFalse('window.hasOwnProperty("f")');
    18 shouldBeTrue('window.__proto__.__proto__.hasOwnProperty("f")');
    19 shouldBeFalse('window.hasOwnProperty("div")');
    20 shouldBeTrue('window.__proto__.__proto__.hasOwnProperty("div")');
    21 shouldBeFalse('window.hasOwnProperty("a")');
     17shouldBeTrue('window.hasOwnProperty("f")');
     18shouldBeTrue('window.hasOwnProperty("div")');
     19shouldBeTrue('window.hasOwnProperty("a")');
    2220
    2321</script>

  • trunk/LayoutTests/fast/loader/window-clearing-expected.txt

    r203935 r204166  
    1010
    1111PASS: element 3 in the window's prototype chain was cleared
    12 
    13 PASS: element 4 in the window's prototype chain was cleared

  • trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt

    r203935 r204166  
    1 CONSOLE MESSAGE: line 2: TypeError: null is not an object (evaluating 'document.body.innerHTML')
     1CONSOLE MESSAGE: line 1: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080".  The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
    22
     3CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'parent.__proto__.alert')
     4

  • trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt

    r203935 r204166  
    1 CONSOLE MESSAGE: line 1: Threw exception: TypeError: Illegal constructor
     1CONSOLE MESSAGE: line 1: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080".  The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
     2
     3CONSOLE MESSAGE: line 1: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080".  The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
     4
    25This passes if it doesn't alert the contents of innocent-victim. 

  • trunk/LayoutTests/http/tests/security/window-named-valueOf.html

    r203935 r204166  
    2424                alert(obj.valueOf.constructor("return document.body.innerHTML")());
    2525            } catch(ex) {
    26                console.log("Threw exception: " + ex)
    2726            }
    2827            if (window.testRunner)

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r204164 r204166  
     12016-08-05  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r203935.
     4        https://bugs.webkit.org/show_bug.cgi?id=160596
     5
     6        looks like a 1-2% PLUM regression on iPhone 6s (Requested by
     7        kling_ on #webkit).
     8
     9        Reverted changeset:
     10
     11        "Window's named properties should be exposed on a
     12        WindowProperties object in its prototype"
     13        https://bugs.webkit.org/show_bug.cgi?id=160354
     14        http://trac.webkit.org/changeset/203935
     15
    1162016-08-05  Youenn Fablet  <youenn@apple.com>
    217

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt

    r204079 r204166  
    51605160PASS Window interface object length
    51615161PASS Window interface object name
    5162 PASS Window interface: existence and properties of interface prototype object
     5162FAIL Window interface: existence and properties of interface prototype object assert_equals: Class name for prototype of Window.prototype is not "WindowProperties" expected "[object WindowProperties]" but got "[object EventTargetPrototype]"
    51635163PASS Window interface: existence and properties of interface prototype object's "constructor" property
    51645164PASS Window interface: attribute self

  • trunk/Source/WebCore/CMakeLists.txt

    r204142 r204166  
    11341134    bindings/js/JSDOMWindowBase.cpp
    11351135    bindings/js/JSDOMWindowCustom.cpp
    1136     bindings/js/JSDOMWindowProperties.cpp
    11371136    bindings/js/JSDOMWindowShell.cpp
    11381137    bindings/js/JSDOMWrapper.cpp

  • trunk/Source/WebCore/ChangeLog

    r204164 r204166  
     12016-08-05  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r203935.
     4        https://bugs.webkit.org/show_bug.cgi?id=160596
     5
     6        looks like a 1-2% PLUM regression on iPhone 6s (Requested by
     7        kling_ on #webkit).
     8
     9        Reverted changeset:
     10
     11        "Window's named properties should be exposed on a
     12        WindowProperties object in its prototype"
     13        https://bugs.webkit.org/show_bug.cgi?id=160354
     14        http://trac.webkit.org/changeset/203935
     15
    1162016-08-05  Youenn Fablet  <youenn@apple.com>
    217

  • trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj

    r204147 r204166  
    17871787                460BB6151D0A1BF000221812 /* Base64Utilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 460BB6131D0A1BEC00221812 /* Base64Utilities.cpp */; };
    17881788                460BB6161D0A1BF000221812 /* Base64Utilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 460BB6141D0A1BEC00221812 /* Base64Utilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1789                 460CBF351D4BCD0E0092E88E /* JSDOMWindowProperties.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 460CBF331D4BCCFE0092E88E /* JSDOMWindowProperties.cpp */; };
    1790                 460CBF361D4BCD0E0092E88E /* JSDOMWindowProperties.h in Headers */ = {isa = PBXBuildFile; fileRef = 460CBF341D4BCCFE0092E88E /* JSDOMWindowProperties.h */; };
    17911789                4634592C1AC2271000ECB71C /* PowerObserverMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4634592B1AC2271000ECB71C /* PowerObserverMac.cpp */; };
    17921790                463EB6221B8789E00096ED51 /* TagCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 463EB6201B8789CB0096ED51 /* TagCollection.cpp */; };
    … …  
    90899087                460BB6131D0A1BEC00221812 /* Base64Utilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Base64Utilities.cpp; sourceTree = "<group>"; };
    90909088                460BB6141D0A1BEC00221812 /* Base64Utilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Base64Utilities.h; sourceTree = "<group>"; };
    9091                 460CBF331D4BCCFE0092E88E /* JSDOMWindowProperties.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMWindowProperties.cpp; sourceTree = "<group>"; };
    9092                 460CBF341D4BCCFE0092E88E /* JSDOMWindowProperties.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMWindowProperties.h; sourceTree = "<group>"; };
    90939089                4634592B1AC2271000ECB71C /* PowerObserverMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PowerObserverMac.cpp; sourceTree = "<group>"; };
    90949090                463EB6201B8789CB0096ED51 /* TagCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TagCollection.cpp; sourceTree = "<group>"; };
    … …  
    1776217758                                9767CE09145ABC12005E64DB /* ExceptionHeaders.h */,
    1776317759                                9767CE0A145ABC13005E64DB /* ExceptionInterfaces.h */,
     17760                                9908B0FD1BCAD07D00ED0F45 /* FetchInternalsBuiltins.cpp */,
    1776417761                                9B03D8061BB3110D00B764B9 /* FetchInternalsBuiltins.h */,
    1776517762                                A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */,
    … …  
    2193921936                                BC6932710D7E293900AE44D1 /* JSDOMWindowBase.cpp */,
    2194021937                                BC6932720D7E293900AE44D1 /* JSDOMWindowBase.h */,
    21941                                 460CBF331D4BCCFE0092E88E /* JSDOMWindowProperties.cpp */,
    21942                                 460CBF341D4BCCFE0092E88E /* JSDOMWindowProperties.h */,
    2194321938                                BCBFB53A0DCD29CF0019B3E5 /* JSDOMWindowShell.cpp */,
    2194421939                                BCBFB53B0DCD29CF0019B3E5 /* JSDOMWindowShell.h */,
    … …  
    2625626251                                81BE20D311F4BC3200915DFA /* JSIDBCursor.h in Headers */,
    2625726252                                C585A68311D4FB08004C3E4B /* JSIDBDatabase.h in Headers */,
    26258                                 460CBF361D4BCD0E0092E88E /* JSDOMWindowProperties.h in Headers */,
    2625926253                                C585A69711D4FB13004C3E4B /* JSIDBFactory.h in Headers */,
    2626026254                                C572EE1F1201C9BC007D8F82 /* JSIDBIndex.h in Headers */,
    … …  
    2909929093                                A8C2280E11D4A59700D5A7D3 /* DocumentParser.cpp in Sources */,
    2910029094                                4A4F48A916B0DFC000EDBB29 /* DocumentRuleSets.cpp in Sources */,
    29101                                 460CBF351D4BCD0E0092E88E /* JSDOMWindowProperties.cpp in Sources */,
    2910229095                                AD6E71AC1668899D00320C13 /* DocumentSharedObjectPool.cpp in Sources */,
    2910329096                                0B9056190F2578BE0095FF6A /* DocumentThreadableLoader.cpp in Sources */,

  • trunk/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp

    r203935 r204166  
    6363#include "JSDOMWindowBase.cpp"
    6464#include "JSDOMWindowCustom.cpp"
    65 #include "JSDOMWindowProperties.cpp"
    6665#include "JSDOMWindowShell.cpp"
    6766#include "JSDOMWrapper.cpp"

  • trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r203935 r204166  
    147147    }
    148148
     149    // Do prototype lookup early so that functions and attributes in the prototype can have
     150    // precedence over the index and name getters.
     151    // FIXME: This seems like a silly idea. It only serves to suppress named property access
     152    // to frames that happen to have names corresponding to properties on the prototype.
     153    // This seems to only serve to leak some information cross-origin.
     154    JSValue proto = thisObject->getPrototypeDirect();
     155    if (proto.isObject() && asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
     156        thisObject->printErrorMessage(errorMessage);
     157        slot.setUndefined();
     158        return true;
     159    }
     160
    149161    // Check for child frames by name before built-in properties to match Mozilla. This does
    150162    // not match IE, but some sites end up naming frames things that conflict with window
    … …  
    159171    slot.setUndefined();
    160172    return true;
     173}
     174
     175static bool jsDOMWindowGetOwnPropertySlotNamedItemGetter(JSDOMWindow* thisObject, Frame& frame, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
     176{
     177    JSValue proto = thisObject->getPrototypeDirect();
     178    if (proto.isObject() && asObject(proto)->hasProperty(exec, propertyName))
     179        return false;
     180
     181    // Check for child frames by name before built-in properties to match Mozilla. This does
     182    // not match IE, but some sites end up naming frames things that conflict with window
     183    // properties that are in Moz but not IE. Since we have some of these, we have to do it
     184    // the Moz way.
     185    if (auto* scopedChild = frame.tree().scopedChild(propertyNameToAtomicString(propertyName))) {
     186        slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, toJS(exec, scopedChild->document()->domWindow()));
     187        return true;
     188    }
     189
     190    // FIXME: Search the whole frame hierarchy somewhere around here.
     191    // We need to test the correct priority order.
     192
     193    // Allow shortcuts like 'Image1' instead of document.images.Image1
     194    Document* document = frame.document();
     195    if (is<HTMLDocument>(*document)) {
     196        auto& htmlDocument = downcast<HTMLDocument>(*document);
     197        auto* atomicPropertyName = propertyName.publicName();
     198        if (atomicPropertyName && htmlDocument.hasWindowNamedItem(*atomicPropertyName)) {
     199            JSValue namedItem;
     200            if (UNLIKELY(htmlDocument.windowNamedItemContainsMultipleElements(*atomicPropertyName))) {
     201                Ref<HTMLCollection> collection = document->windowNamedItems(atomicPropertyName);
     202                ASSERT(collection->length() > 1);
     203                namedItem = toJS(exec, thisObject->globalObject(), collection);
     204            } else
     205                namedItem = toJS(exec, thisObject->globalObject(), htmlDocument.windowNamedItem(*atomicPropertyName));
     206            slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, namedItem);
     207            return true;
     208        }
     209    }
     210
     211    return false;
    161212}
    162213
    … …  
    204255#endif
    205256
    206     return false;
     257    // (3) Finally, named properties.
     258    // Really, this should just be 'return false;' - these should all be on the NPO.
     259    return jsDOMWindowGetOwnPropertySlotNamedItemGetter(thisObject, *frame, exec, propertyName, slot);
    207260}
    208261
    … …  
    232285
    233286    // (2) Regular own properties.
    234     return Base::getOwnPropertySlotByIndex(thisObject, exec, index, slot);
     287    if (Base::getOwnPropertySlotByIndex(thisObject, exec, index, slot))
     288        return true;
     289
     290    // (3) Finally, named properties.
     291    // Really, this should just be 'return false;' - these should all be on the NPO.
     292    return jsDOMWindowGetOwnPropertySlotNamedItemGetter(thisObject, *frame, exec, Identifier::from(exec, index), slot);
    235293}
    236294

  • trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp

    r203935 r204166  
    3333#include "GCController.h"
    3434#include "JSDOMWindow.h"
    35 #include "JSDOMWindowProperties.h"
    3635#include "JSEventTarget.h"
    3736#include "ScriptController.h"
    … …  
    8786    JSDOMWindow* jsDOMWindow = JSDOMWindow::create(vm, structure, *domWindow, this);
    8887    prototype->structure()->setGlobalObject(vm, jsDOMWindow);
    89 
    90     Structure* windowPropertiesStructure = JSDOMWindowProperties::createStructure(vm, jsDOMWindow, JSEventTarget::prototype(vm, jsDOMWindow));
    91     JSDOMWindowProperties* windowProperties = JSDOMWindowProperties::create(windowPropertiesStructure, *jsDOMWindow);
    92 
    93     prototype->structure()->setPrototypeWithoutTransition(vm, windowProperties);
     88    prototype->structure()->setPrototypeWithoutTransition(vm, JSEventTarget::prototype(vm, jsDOMWindow));
    9489    setWindow(vm, jsDOMWindow);
    9590    ASSERT(jsDOMWindow->globalObject() == jsDOMWindow);
Note: See TracChangeset for help on using the changeset viewer.