⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 246378 in webkit


Ignore:
Timestamp:
Jun 12, 2019, 3:20:51 PM (7 years ago)
Author:
Kocsen Chung
Message:

Cherry-pick r246040. rdar://problem/51656856

[JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
​https://bugs.webkit.org/show_bug.cgi?id=198477
<rdar://problem/51299504>

Reviewed by Saam Barati.

Source/JavaScriptCore:

JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
handle getPrototype methods in derived JSObject classes correctly.

  • runtime/JSArrayInlines.h: (JSC::JSArray::pushInline):
  • runtime/JSObject.cpp: (JSC::JSObject::putByIndex): (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype): (JSC::JSObject::attemptToInterceptPutByIndexOnHole): (JSC::JSObject::putByIndexBeyondVectorLength):

LayoutTests:

Ensure that JSWindow::getPrototype is used.

  • http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
  • http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
  • http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246040 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch
Files:
3 added
4 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/LayoutTests/ChangeLog

    r245934 r246378  
     12019-06-12  Null  <null@apple.com>
     2
     3        Cherry-pick r246040. rdar://problem/51656856
     4
     5    [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     6    https://bugs.webkit.org/show_bug.cgi?id=198477
     7    <rdar://problem/51299504>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    Source/JavaScriptCore:
     12   
     13    JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
     14    handle getPrototype methods in derived JSObject classes correctly.
     15   
     16    * runtime/JSArrayInlines.h:
     17    (JSC::JSArray::pushInline):
     18    * runtime/JSObject.cpp:
     19    (JSC::JSObject::putByIndex):
     20    (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
     21    (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
     22    (JSC::JSObject::putByIndexBeyondVectorLength):
     23   
     24    LayoutTests:
     25   
     26    Ensure that JSWindow::getPrototype is used.
     27   
     28    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
     29    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
     30    * http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.
     31   
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2019-06-03  Yusuke Suzuki  <ysuzuki@apple.com>
     36
     37            [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     38            https://bugs.webkit.org/show_bug.cgi?id=198477
     39            <rdar://problem/51299504>
     40
     41            Reviewed by Saam Barati.
     42
     43            Ensure that JSWindow::getPrototype is used.
     44
     45            * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
     46            * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
     47            * http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.
     48
    1492019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    250

  • branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

    r245939 r246378  
     12019-06-12  Null  <null@apple.com>
     2
     3        Cherry-pick r246040. rdar://problem/51656856
     4
     5    [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     6    https://bugs.webkit.org/show_bug.cgi?id=198477
     7    <rdar://problem/51299504>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    Source/JavaScriptCore:
     12   
     13    JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
     14    handle getPrototype methods in derived JSObject classes correctly.
     15   
     16    * runtime/JSArrayInlines.h:
     17    (JSC::JSArray::pushInline):
     18    * runtime/JSObject.cpp:
     19    (JSC::JSObject::putByIndex):
     20    (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
     21    (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
     22    (JSC::JSObject::putByIndexBeyondVectorLength):
     23   
     24    LayoutTests:
     25   
     26    Ensure that JSWindow::getPrototype is used.
     27   
     28    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
     29    * http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
     30    * http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.
     31   
     32   
     33    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246040 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     34
     35    2019-06-03  Yusuke Suzuki  <ysuzuki@apple.com>
     36
     37            [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
     38            https://bugs.webkit.org/show_bug.cgi?id=198477
     39            <rdar://problem/51299504>
     40
     41            Reviewed by Saam Barati.
     42
     43            JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
     44            handle getPrototype methods in derived JSObject classes correctly.
     45
     46            * runtime/JSArrayInlines.h:
     47            (JSC::JSArray::pushInline):
     48            * runtime/JSObject.cpp:
     49            (JSC::JSObject::putByIndex):
     50            (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
     51            (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
     52            (JSC::JSObject::putByIndexBeyondVectorLength):
     53
    1542019-05-30  Alan Coon  <alancoon@apple.com>
    255

  • branches/safari-607-branch/Source/JavaScriptCore/runtime/JSArrayInlines.h

    r237447 r246378  
    213213        unsigned oldLength = length();
    214214        bool putResult = false;
    215         if (attemptToInterceptPutByIndexOnHole(exec, oldLength, value, true, putResult)) {
    216             if (!scope.exception() && oldLength < 0xFFFFFFFFu) {
     215        bool result = attemptToInterceptPutByIndexOnHole(exec, oldLength, value, true, putResult);
     216        RETURN_IF_EXCEPTION(scope, void());
     217        if (result) {
     218            if (oldLength < 0xFFFFFFFFu) {
    217219                scope.release();
    218220                setLength(exec, oldLength + 1, true);

  • branches/safari-607-branch/Source/JavaScriptCore/runtime/JSObject.cpp

    r242859 r246378  
    917917        WriteBarrier<Unknown>& valueSlot = storage->m_vector[propertyName];
    918918        unsigned length = storage->length();
     919
     920        auto scope = DECLARE_THROW_SCOPE(vm);
    919921       
    920922        // Update length & m_numValuesInVector as necessary.
    921923        if (propertyName >= length) {
    922924            bool putResult = false;
    923             if (thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult))
     925            bool result = thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult);
     926            RETURN_IF_EXCEPTION(scope, false);
     927            if (result)
    924928                return putResult;
    925929            length = propertyName + 1;
    … …  
    928932        } else if (!valueSlot) {
    929933            bool putResult = false;
    930             if (thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult))
     934            bool result = thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult);
     935            RETURN_IF_EXCEPTION(scope, false);
     936            if (result)
    931937                return putResult;
    932938            ++storage->m_numValuesInVector;
    … …  
    26772683{
    26782684    VM& vm = exec->vm();
     2685    auto scope = DECLARE_THROW_SCOPE(vm);
     2686
    26792687    for (JSObject* current = this; ;) {
    26802688        // This has the same behavior with respect to prototypes as JSObject::put(). It only
    … …  
    26872695            SparseArrayValueMap::iterator iter = storage->m_sparseMap->find(i);
    26882696            if (iter != storage->m_sparseMap->notFound() && (iter->value.attributes() & (PropertyAttribute::Accessor | PropertyAttribute::ReadOnly))) {
     2697                scope.release();
    26892698                putResult = iter->value.put(exec, thisValue, storage->m_sparseMap.get(), value, shouldThrow);
    26902699                return true;
    … …  
    26932702
    26942703        if (current->type() == ProxyObjectType) {
     2704            scope.release();
    26952705            ProxyObject* proxy = jsCast<ProxyObject*>(current);
    26962706            putResult = proxy->putByIndexCommon(exec, thisValue, i, value, shouldThrow);
    … …  
    26982708        }
    26992709       
    2700         JSValue prototypeValue = current->getPrototypeDirect(vm);
     2710        JSValue prototypeValue = current->getPrototype(vm, exec);
     2711        RETURN_IF_EXCEPTION(scope, false);
    27012712        if (prototypeValue.isNull())
    27022713            return false;
    … …  
    27082719bool JSObject::attemptToInterceptPutByIndexOnHole(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, bool& putResult)
    27092720{
    2710     JSValue prototypeValue = getPrototypeDirect(exec->vm());
     2721    VM& vm = exec->vm();
     2722    auto scope = DECLARE_THROW_SCOPE(vm);
     2723
     2724    JSValue prototypeValue = getPrototype(vm, exec);
     2725    RETURN_IF_EXCEPTION(scope, false);
    27112726    if (prototypeValue.isNull())
    27122727        return false;
    27132728   
    2714     return asObject(prototypeValue)->attemptToInterceptPutByIndexOnHoleForPrototype(exec, this, i, value, shouldThrow, putResult);
     2729    RELEASE_AND_RETURN(scope, asObject(prototypeValue)->attemptToInterceptPutByIndexOnHoleForPrototype(exec, this, i, value, shouldThrow, putResult));
    27152730}
    27162731
    … …  
    28982913    case ArrayWithSlowPutArrayStorage: {
    28992914        // No own property present in the vector, but there might be in the sparse map!
     2915        auto scope = DECLARE_THROW_SCOPE(vm);
    29002916        SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get();
    29012917        bool putResult = false;
    2902         if (!(map && map->contains(i)) && attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow, putResult))
    2903             return putResult;
     2918        if (!(map && map->contains(i))) {
     2919            bool result = attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow, putResult);
     2920            RETURN_IF_EXCEPTION(scope, false);
     2921            if (result)
     2922                return putResult;
     2923        }
     2924        scope.release();
    29042925        FALLTHROUGH;
    29052926    }
Note: See TracChangeset for help on using the changeset viewer.