⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 246364 in webkit


Ignore:
Timestamp:
Jun 12, 2019, 11:16:06 AM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r246040. rdar://problem/51670920

[JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
​https://bugs.webkit.org/show_bug.cgi?id=198477
<rdar://problem/51299504>

Reviewed by Saam Barati.

Source/JavaScriptCore:

JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
handle getPrototype methods in derived JSObject classes correctly.

  • runtime/JSArrayInlines.h: (JSC::JSArray::pushInline):
  • runtime/JSObject.cpp: (JSC::JSObject::putByIndex): (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype): (JSC::JSObject::attemptToInterceptPutByIndexOnHole): (JSC::JSObject::putByIndexBeyondVectorLength):

LayoutTests:

Ensure that JSWindow::getPrototype is used.

  • http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
  • http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
  • http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246040 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607.3.1.2-branch
Files:
3 added
4 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607.3.1.2-branch/LayoutTests/ChangeLog

    r245910 r246364  
     12019-06-12  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r246040. rdar://problem/51670920
     4
     5    [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     6    https://bugs.webkit.org/show_bug.cgi?id=198477
     7    <rdar://problem/51299504>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    Source/JavaScriptCore:
     12   
     13    JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
     14    handle getPrototype methods in derived JSObject classes correctly.
     15   
     16    * runtime/JSArrayInlines.h:
     17    (JSC::JSArray::pushInline):
     18    * runtime/JSObject.cpp:
     19    (JSC::JSObject::putByIndex):
     20    (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
     21    (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
     22    (JSC::JSObject::putByIndexBeyondVectorLength):
     23   
     24    LayoutTests:
     25   
     26    Ensure that JSWindow::getPrototype is used.
     27   
     28    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
     29    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
     30    * http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.
     31   
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2019-06-03  Yusuke Suzuki  <ysuzuki@apple.com>
     36
     37            [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     38            https://bugs.webkit.org/show_bug.cgi?id=198477
     39            <rdar://problem/51299504>
     40
     41            Reviewed by Saam Barati.
     42
     43            Ensure that JSWindow::getPrototype is used.
     44
     45            * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
     46            * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
     47            * http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.
     48
    1492019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    250

  • branches/safari-607.3.1.2-branch/Source/JavaScriptCore/ChangeLog

    r245910 r246364  
     12019-06-12  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r246040. rdar://problem/51670920
     4
     5    [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     6    https://bugs.webkit.org/show_bug.cgi?id=198477
     7    <rdar://problem/51299504>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    Source/JavaScriptCore:
     12   
     13    JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
     14    handle getPrototype methods in derived JSObject classes correctly.
     15   
     16    * runtime/JSArrayInlines.h:
     17    (JSC::JSArray::pushInline):
     18    * runtime/JSObject.cpp:
     19    (JSC::JSObject::putByIndex):
     20    (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
     21    (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
     22    (JSC::JSObject::putByIndexBeyondVectorLength):
     23   
     24    LayoutTests:
     25   
     26    Ensure that JSWindow::getPrototype is used.
     27   
     28    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
     29    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
     30    * http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.
     31   
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2019-06-03  Yusuke Suzuki  <ysuzuki@apple.com>
     36
     37            [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     38            https://bugs.webkit.org/show_bug.cgi?id=198477
     39            <rdar://problem/51299504>
     40
     41            Reviewed by Saam Barati.
     42
     43            JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
     44            handle getPrototype methods in derived JSObject classes correctly.
     45
     46            * runtime/JSArrayInlines.h:
     47            (JSC::JSArray::pushInline):
     48            * runtime/JSObject.cpp:
     49            (JSC::JSObject::putByIndex):
     50            (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
     51            (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
     52            (JSC::JSObject::putByIndexBeyondVectorLength):
     53
    1542019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    255

  • branches/safari-607.3.1.2-branch/Source/JavaScriptCore/runtime/JSArrayInlines.h

    r237447 r246364  
    213213        unsigned oldLength = length();
    214214        bool putResult = false;
    215         if (attemptToInterceptPutByIndexOnHole(exec, oldLength, value, true, putResult)) {
    216             if (!scope.exception() && oldLength < 0xFFFFFFFFu) {
     215        bool result = attemptToInterceptPutByIndexOnHole(exec, oldLength, value, true, putResult);
     216        RETURN_IF_EXCEPTION(scope, void());
     217        if (result) {
     218            if (oldLength < 0xFFFFFFFFu) {
    217219                scope.release();
    218220                setLength(exec, oldLength + 1, true);

  • branches/safari-607.3.1.2-branch/Source/JavaScriptCore/runtime/JSObject.cpp

    r239557 r246364  
    916916        WriteBarrier<Unknown>& valueSlot = storage->m_vector[propertyName];
    917917        unsigned length = storage->length();
     918
     919        auto scope = DECLARE_THROW_SCOPE(vm);
    918920       
    919921        // Update length & m_numValuesInVector as necessary.
    920922        if (propertyName >= length) {
    921923            bool putResult = false;
    922             if (thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult))
     924            bool result = thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult);
     925            RETURN_IF_EXCEPTION(scope, false);
     926            if (result)
    923927                return putResult;
    924928            length = propertyName + 1;
    … …  
    927931        } else if (!valueSlot) {
    928932            bool putResult = false;
    929             if (thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult))
     933            bool result = thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult);
     934            RETURN_IF_EXCEPTION(scope, false);
     935            if (result)
    930936                return putResult;
    931937            ++storage->m_numValuesInVector;
    … …  
    26712677{
    26722678    VM& vm = exec->vm();
     2679    auto scope = DECLARE_THROW_SCOPE(vm);
     2680
    26732681    for (JSObject* current = this; ;) {
    26742682        // This has the same behavior with respect to prototypes as JSObject::put(). It only
    … …  
    26812689            SparseArrayValueMap::iterator iter = storage->m_sparseMap->find(i);
    26822690            if (iter != storage->m_sparseMap->notFound() && (iter->value.attributes() & (PropertyAttribute::Accessor | PropertyAttribute::ReadOnly))) {
     2691                scope.release();
    26832692                putResult = iter->value.put(exec, thisValue, storage->m_sparseMap.get(), value, shouldThrow);
    26842693                return true;
    … …  
    26872696
    26882697        if (current->type() == ProxyObjectType) {
     2698            scope.release();
    26892699            ProxyObject* proxy = jsCast<ProxyObject*>(current);
    26902700            putResult = proxy->putByIndexCommon(exec, thisValue, i, value, shouldThrow);
    … …  
    26922702        }
    26932703       
    2694         JSValue prototypeValue = current->getPrototypeDirect(vm);
     2704        JSValue prototypeValue = current->getPrototype(vm, exec);
     2705        RETURN_IF_EXCEPTION(scope, false);
    26952706        if (prototypeValue.isNull())
    26962707            return false;
    … …  
    27022713bool JSObject::attemptToInterceptPutByIndexOnHole(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, bool& putResult)
    27032714{
    2704     JSValue prototypeValue = getPrototypeDirect(exec->vm());
     2715    VM& vm = exec->vm();
     2716    auto scope = DECLARE_THROW_SCOPE(vm);
     2717
     2718    JSValue prototypeValue = getPrototype(vm, exec);
     2719    RETURN_IF_EXCEPTION(scope, false);
    27052720    if (prototypeValue.isNull())
    27062721        return false;
    27072722   
    2708     return asObject(prototypeValue)->attemptToInterceptPutByIndexOnHoleForPrototype(exec, this, i, value, shouldThrow, putResult);
     2723    RELEASE_AND_RETURN(scope, asObject(prototypeValue)->attemptToInterceptPutByIndexOnHoleForPrototype(exec, this, i, value, shouldThrow, putResult));
    27092724}
    27102725
    … …  
    28922907    case ArrayWithSlowPutArrayStorage: {
    28932908        // No own property present in the vector, but there might be in the sparse map!
     2909        auto scope = DECLARE_THROW_SCOPE(vm);
    28942910        SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get();
    28952911        bool putResult = false;
    2896         if (!(map && map->contains(i)) && attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow, putResult))
    2897             return putResult;
     2912        if (!(map && map->contains(i))) {
     2913            bool result = attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow, putResult);
     2914            RETURN_IF_EXCEPTION(scope, false);
     2915            if (result)
     2916                return putResult;
     2917        }
     2918        scope.release();
    28982919        FALLTHROUGH;
    28992920    }
Note: See TracChangeset for help on using the changeset viewer.