Changeset 235730 in webkit

Timestamp:

Sep 6, 2018, 1:11:57 AM (8 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r235715. rdar://problem/44169344

JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
​https://bugs.webkit.org/show_bug.cgi?id=189124
<rdar://problem/43863605>

Reviewed by Filip Pizlo.

JSTests:

• stress/regress-189124.js: Added.

Source/JavaScriptCore:

It is assumed that the Structure for the m_cachedStructureID will remain alive
while the m_cachedStructureID is in use. This prevents the structureID from being
re-used for a different Structure.

• runtime/JSPropertyNameEnumerator.cpp: (JSC::JSPropertyNameEnumerator::visitChildren):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@235715 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-606-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-189124.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp (modified) (2 diffs)

branches/safari-606-branch/JSTests/ChangeLog

@@ +1 @@
+2018-09-06  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r235715. rdar://problem/44169344
+
+    JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
+    https://bugs.webkit.org/show_bug.cgi?id=189124
+    <rdar://problem/43863605>
+    
+    Reviewed by Filip Pizlo.
+    
+    JSTests:
+    
+    * stress/regress-189124.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    It is assumed that the Structure for the m_cachedStructureID will remain alive
+    while the m_cachedStructureID is in use.  This prevents the structureID from being
+    re-used for a different Structure.
+    
+    * runtime/JSPropertyNameEnumerator.cpp:
+    (JSC::JSPropertyNameEnumerator::visitChildren):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235715 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2018-09-05  Mark Lam  <mark.lam@apple.com>
+
+            JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
+            https://bugs.webkit.org/show_bug.cgi?id=189124
+            <rdar://problem/43863605>
+
+            Reviewed by Filip Pizlo.
+
+            * stress/regress-189124.js: Added.
+
 2018-09-06  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-606-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-09-06  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r235715. rdar://problem/44169344
+
+    JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
+    https://bugs.webkit.org/show_bug.cgi?id=189124
+    <rdar://problem/43863605>
+    
+    Reviewed by Filip Pizlo.
+    
+    JSTests:
+    
+    * stress/regress-189124.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    It is assumed that the Structure for the m_cachedStructureID will remain alive
+    while the m_cachedStructureID is in use.  This prevents the structureID from being
+    re-used for a different Structure.
+    
+    * runtime/JSPropertyNameEnumerator.cpp:
+    (JSC::JSPropertyNameEnumerator::visitChildren):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235715 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2018-09-05  Mark Lam  <mark.lam@apple.com>
+
+            JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
+            https://bugs.webkit.org/show_bug.cgi?id=189124
+            <rdar://problem/43863605>
+
+            Reviewed by Filip Pizlo.
+
+            It is assumed that the Structure for the m_cachedStructureID will remain alive
+            while the m_cachedStructureID is in use.  This prevents the structureID from being
+            re-used for a different Structure.
+
+            * runtime/JSPropertyNameEnumerator.cpp:
+            (JSC::JSPropertyNameEnumerator::visitChildren):
+
 2018-09-06  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-606-branch/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2018 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -94 +94 @@
         visitor.append(propertyName);
     visitor.append(thisObject->m_prototypeChain);
+
+    VM& vm = visitor.vm();
+    visitor.appendUnbarriered(vm.getStructure(thisObject->cachedStructureID()));
 }