⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 259654 in webkit


Ignore:
Timestamp:
Apr 7, 2020, 11:43:30 AM (6 years ago)
Author:
Alan Coon
Message:

Cherry-pick r257605. rdar://problem/61231926

Poly proto should work with property delete transitions
​https://bugs.webkit.org/show_bug.cgi?id=208261

Reviewed by Saam Barati.

JSTests:

  • stress/delete-property-poly-proto.js: Added. (A.prototype.set x): (A): (B):

Source/JavaScriptCore:

This patch fixes a bug where the combination of inline caching
and poly proto cause us to cache a setter call along a prototype chain that
is no longer the correct setter to call. This is exposed as a result of
​https://bugs.webkit.org/show_bug.cgi?id=206430 since DefineOwnProperty used
to transition to uncacheable dictionary.

The case looks like this:
A - setter for x redefines x
|
B
|
C

We set (new C).x

Right now, we first call A's setter, then we try to figure out what the state of things
were before it was called in order to cache it. We just assume that A's setter still exists, and we cache it
without ever checking, In this patch, we ensure that the property exists and the attributes match in order to prevent crashing.

In the code, A = target, C = base.

Get is correct because it collects caching information before any calls.

The bug ​https://bugs.webkit.org/show_bug.cgi?id=208337 tracks the remaining semantic bugs around this code.

  • jit/Repatch.cpp: (JSC::tryCachePutByID):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@257605 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-609.2.1.2-branch
Files:
4 added
3 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-609.2.1.2-branch/JSTests/ChangeLog

    r259487 r259654  
     12020-04-07  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r257605. rdar://problem/61231926
     4
     5    Poly proto should work with property delete transitions
     6    https://bugs.webkit.org/show_bug.cgi?id=208261
     7   
     8    Reviewed by Saam Barati.
     9   
     10    JSTests:
     11   
     12    * stress/delete-property-poly-proto.js: Added.
     13    (A.prototype.set x):
     14    (A):
     15    (B):
     16   
     17    Source/JavaScriptCore:
     18   
     19    This patch fixes a bug where the combination of inline caching
     20    and poly proto cause us to cache a setter call along a prototype chain that
     21    is no longer the correct setter to call. This is exposed as a result of
     22    https://bugs.webkit.org/show_bug.cgi?id=206430 since DefineOwnProperty used
     23    to transition to uncacheable dictionary.
     24   
     25    The case looks like this:
     26    A - setter for x redefines x
     27    |
     28    B
     29    |
     30    C
     31   
     32    We set (new C).x
     33   
     34    Right now, we first call A's setter, then we try to figure out what the state of things
     35    were before it was called in order to cache it. We just assume that A's setter still exists, and we cache it
     36    without ever checking, In this patch, we ensure that the property exists and the attributes match in order to prevent crashing.
     37   
     38    In the code, A = target, C = base.
     39   
     40    Get is correct because it collects caching information before any calls.
     41   
     42    The bug https://bugs.webkit.org/show_bug.cgi?id=208337 tracks the remaining semantic bugs around this code.
     43   
     44    * jit/Repatch.cpp:
     45    (JSC::tryCachePutByID):
     46   
     47   
     48    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@257605 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     49
     50    2020-02-27  Justin Michaud  <justin_michaud@apple.com>
     51
     52            Poly proto should work with property delete transitions
     53            https://bugs.webkit.org/show_bug.cgi?id=208261
     54
     55            Reviewed by Saam Barati.
     56
     57            * stress/delete-property-poly-proto.js: Added.
     58            (A.prototype.set x):
     59            (A):
     60            (B):
     61
    1622020-04-03  Alan Coon  <alancoon@apple.com>
    263

  • branches/safari-609.2.1.2-branch/Source/JavaScriptCore/ChangeLog

    r259653 r259654  
     12020-04-07  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r257605. rdar://problem/61231926
     4
     5    Poly proto should work with property delete transitions
     6    https://bugs.webkit.org/show_bug.cgi?id=208261
     7   
     8    Reviewed by Saam Barati.
     9   
     10    JSTests:
     11   
     12    * stress/delete-property-poly-proto.js: Added.
     13    (A.prototype.set x):
     14    (A):
     15    (B):
     16   
     17    Source/JavaScriptCore:
     18   
     19    This patch fixes a bug where the combination of inline caching
     20    and poly proto cause us to cache a setter call along a prototype chain that
     21    is no longer the correct setter to call. This is exposed as a result of
     22    https://bugs.webkit.org/show_bug.cgi?id=206430 since DefineOwnProperty used
     23    to transition to uncacheable dictionary.
     24   
     25    The case looks like this:
     26    A - setter for x redefines x
     27    |
     28    B
     29    |
     30    C
     31   
     32    We set (new C).x
     33   
     34    Right now, we first call A's setter, then we try to figure out what the state of things
     35    were before it was called in order to cache it. We just assume that A's setter still exists, and we cache it
     36    without ever checking, In this patch, we ensure that the property exists and the attributes match in order to prevent crashing.
     37   
     38    In the code, A = target, C = base.
     39   
     40    Get is correct because it collects caching information before any calls.
     41   
     42    The bug https://bugs.webkit.org/show_bug.cgi?id=208337 tracks the remaining semantic bugs around this code.
     43   
     44    * jit/Repatch.cpp:
     45    (JSC::tryCachePutByID):
     46   
     47   
     48    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@257605 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     49
     50    2020-02-27  Justin Michaud  <justin_michaud@apple.com>
     51
     52            Poly proto should work with property delete transitions
     53            https://bugs.webkit.org/show_bug.cgi?id=208261
     54
     55            Reviewed by Saam Barati.
     56
     57            This patch fixes a bug where the combination of inline caching
     58            and poly proto cause us to cache a setter call along a prototype chain that
     59            is no longer the correct setter to call. This is exposed as a result of
     60            https://bugs.webkit.org/show_bug.cgi?id=206430 since DefineOwnProperty used
     61            to transition to uncacheable dictionary.
     62
     63            The case looks like this:
     64            A - setter for x redefines x
     65            |
     66            B
     67            |
     68            C
     69
     70            We set (new C).x
     71
     72            Right now, we first call A's setter, then we try to figure out what the state of things
     73            were before it was called in order to cache it. We just assume that A's setter still exists, and we cache it
     74            without ever checking, In this patch, we ensure that the property exists and the attributes match in order to prevent crashing.
     75
     76            In the code, A = target, C = base.
     77
     78            Get is correct because it collects caching information before any calls.
     79
     80            The bug https://bugs.webkit.org/show_bug.cgi?id=208337 tracks the remaining semantic bugs around this code.
     81
     82            * jit/Repatch.cpp:
     83            (JSC::tryCachePutByID):
     84
    1852020-04-07  Alan Coon  <alancoon@apple.com>
    286

  • branches/safari-609.2.1.2-branch/Source/JavaScriptCore/jit/Repatch.cpp

    r259653 r259654  
    689689                        if (!prototypeAccessChain)
    690690                            return GiveUpOnCache;
    691                         offset = prototypeAccessChain->slotBaseStructure(vm, baseCell->structure(vm))->get(vm, ident.impl());
     691                        unsigned attributes;
     692                        offset = prototypeAccessChain->slotBaseStructure(vm, baseCell->structure(vm))->get(vm, ident.impl(), attributes);
     693                        if (!isValidOffset(offset) || !(attributes & PropertyAttribute::Accessor))
     694                            return RetryCacheLater;
    692695                    } else {
    693696                        prototypeAccessChain = nullptr;
Note: See TracChangeset for help on using the changeset viewer.