Changeset 211116 in webkit

Timestamp:

Jan 24, 2017, 3:29:30 PM (10 years ago)

Author:

matthew_hanson@apple.com

Message:

Merge r211070. rdar://problem/30121809

Location:

branches/safari-603-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/spread-consults-correct-global-object.js (added)
• JSTests/stress/spread-correct-global-object-on-exception.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (4 diffs)
• Source/JavaScriptCore/jsc.cpp (modified) (3 diffs)
• Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (modified) (2 diffs)
• Source/JavaScriptCore/runtime/JSArray.h (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSArrayInlines.h (modified) (1 diff)

branches/safari-603-branch/JSTests/ChangeLog

@@ +1 @@
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211070. rdar://problem/30121809
+
+    2017-01-23  Saam Barati  <sbarati@apple.com>
+
+            https://bugs.webkit.org/show_bug.cgi?id=167247
+            JSC: operationSpreadGeneric uses the wrong global object for the builtin function and slow_path_spread consults the wrong global object to prove if the iterator protocol is unobservable
+            <rdar://problem/30121809>
+
+            Reviewed by Filip Pizlo.
+
+            * stress/spread-consults-correct-global-object.js: Added.
+            (assert):
+            (spread):
+            * stress/spread-correct-global-object-on-exception.js: Added.
+            (assert):
+            (spread):
+            (const.objectText.let.o.Symbol.iterator):
+            (catch):
+
 2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-603-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211070. rdar://problem/30121809
+
+    2017-01-23  Saam Barati  <sbarati@apple.com>
+
+            https://bugs.webkit.org/show_bug.cgi?id=167247
+            JSC: operationSpreadGeneric uses the wrong global object for the builtin function and slow_path_spread consults the wrong global object to prove if the iterator protocol is unobservable
+            <rdar://problem/30121809>
+
+            Reviewed by Filip Pizlo.
+
+            There were two bugs in the different tiers with respect to how
+            spread handled global objects.
+
+            The first was in the LLInt/baseline inside slow_path_spread:
+
+            We consulted the lexical global object instead of the thing we're
+            spreading's global object to determine if the array iterator protocol
+            is unobservable. This is wrong if the incoming array is from a different
+            global object. We must consult the incoming array's global object
+            to determine if it can be spread using the fast path.
+
+            The second was in operationSpreadGeneric in the DFG/FTL:
+
+            We were always using the incoming array's global object, even
+            when going down the slow path. This is wrong because we were
+            fetching the builtin iteration function helper from the incoming
+            array's global object, which meant that if the iterator function
+            were to throw an exception, it could leak objects from a different
+            global object. We should be executing the iterator function with
+            the lexical global object.
+
+            * dfg/DFGOperations.cpp:
+            * jsc.cpp:
+            (GlobalObject::finishCreation):
+            (functionGlobalObjectForObject):
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::SLOW_PATH_DECL):
+            * runtime/JSArray.h:
+            * runtime/JSArrayInlines.h:
+            (JSC::JSArray::isIteratorProtocolFastAndNonObservable):
+
 2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
 

branches/safari-603-branch/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -48 +48 @@
 #include "JIT.h"
 #include "JITExceptions.h"
+#include "JSArrayInlines.h"
 #include "JSCInlines.h"
 #include "JSFixedArray.h"
@@ -1985 +1986 @@
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    JSGlobalObject* globalObject = iterable->structure(vm)->globalObject();
-    if (!globalObject)
-        globalObject = exec->lexicalGlobalObject();
-
-    if (isJSArray(iterable) && globalObject->isArrayIteratorProtocolFastAndNonObservable()) {
+    if (isJSArray(iterable)) {
         JSArray* array = jsCast<JSArray*>(iterable);
-        throwScope.release();
-        return JSFixedArray::createFromArray(exec, vm, array);
+        if (array->isIteratorProtocolFastAndNonObservable()) {
+            throwScope.release();
+            return JSFixedArray::createFromArray(exec, vm, array);
+        }
     }
 
@@ -1998 +1997 @@
     // the iteration protocol builtin: https://bugs.webkit.org/show_bug.cgi?id=164520
 
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     JSArray* array;
     {
@@ -2023 +2023 @@
     ASSERT(isJSArray(cell));
     JSArray* array = jsCast<JSArray*>(cell);
-    ASSERT(array->globalObject()->isArrayIteratorProtocolFastAndNonObservable());
+    ASSERT(array->isIteratorProtocolFastAndNonObservable());
 
     return JSFixedArray::createFromArray(exec, vm, array);

branches/safari-603-branch/Source/JavaScriptCore/jsc.cpp

@@ -1008 +1008 @@
 static EncodedJSValue JSC_HOST_CALL functionSetRandomSeed(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionIsRope(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGlobalObjectForObject(ExecState*);
 
 struct Script {
@@ -1231 +1232 @@
         addFunction(vm, "setRandomSeed", functionSetRandomSeed, 1);
         addFunction(vm, "isRope", functionIsRope, 1);
+
+        addFunction(vm, "globalObjectForObject", functionGlobalObjectForObject, 1);
 
         addFunction(vm, "is32BitPlatform", functionIs32BitPlatform, 0);
@@ -2105 +2108 @@
 }
 
+EncodedJSValue JSC_HOST_CALL functionGlobalObjectForObject(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+    RELEASE_ASSERT(value.isObject());
+    JSGlobalObject* globalObject = jsCast<JSObject*>(value)->globalObject();
+    RELEASE_ASSERT(globalObject);
+    return JSValue::encode(globalObject);
+}
+
 EncodedJSValue JSC_HOST_CALL functionReadline(ExecState* exec)
 {

branches/safari-603-branch/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -44 +44 @@
 #include "IteratorOperations.h"
 #include "JIT.h"
+#include "JSArrayInlines.h"
 #include "JSCInlines.h"
 #include "JSCJSValue.h"
@@ -1035 +1036 @@
     JSValue iterable = OP_C(2).jsValue();
 
+    if (iterable.isCell() && isJSArray(iterable.asCell())) {
+        JSArray* array = jsCast<JSArray*>(iterable);
+        if (array->isIteratorProtocolFastAndNonObservable()) {
+            // JSFixedArray::createFromArray does not consult the prototype chain,
+            // so we must be sure that not consulting the prototype chain would
+            // produce the same value during iteration.
+            RETURN(JSFixedArray::createFromArray(exec, vm, array));
+        }
+    }
+
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-
-    if (iterable.isCell() && isJSArray(iterable.asCell()) && globalObject->isArrayIteratorProtocolFastAndNonObservable()) {
-        // JSFixedArray::createFromArray does not consult the prototype chain,
-        // so we must be sure that not consulting the prototype chain would
-        // produce the same value during iteration.
-        JSArray* array = jsCast<JSArray*>(iterable);
-        RETURN(JSFixedArray::createFromArray(exec, vm, array));
-    }
 
     JSArray* array;

branches/safari-603-branch/Source/JavaScriptCore/runtime/JSArray.h

@@ -150 +150 @@
     JS_EXPORT_PRIVATE void fillArgList(ExecState*, MarkedArgumentBuffer&);
     JS_EXPORT_PRIVATE void copyToArguments(ExecState*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
+
+    bool isIteratorProtocolFastAndNonObservable();
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, IndexingType indexingType)

branches/safari-603-branch/Source/JavaScriptCore/runtime/JSArrayInlines.h

@@ -94 +94 @@
 }
 
+ALWAYS_INLINE bool JSArray::isIteratorProtocolFastAndNonObservable()
+{
+    return globalObject()->isArrayIteratorProtocolFastAndNonObservable();
+}
+
 } // namespace JSC