Changeset 263292 in webkit

Timestamp:

Jun 19, 2020, 3:40:26 PM (6 years ago)

Author:

mark.lam@apple.com

Message:

toString of String doesn't check integrity of structureID in one path.
​https://bugs.webkit.org/show_bug.cgi?id=213338

Reviewed by Saam Barati.

• runtime/StringPrototype.cpp:

(JSC::stringProtoFuncToString):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/StringPrototype.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-06-19  Mark Lam  <mark.lam@apple.com>
+
+        toString of String doesn't check integrity of structureID in one path.
+        https://bugs.webkit.org/show_bug.cgi?id=213338
+
+        Reviewed by Saam Barati.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToString):
+
 2020-06-19  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp

@@ -959 +959 @@
     // Also used for valueOf.
 
-    if (thisValue.isString())
+    if (thisValue.isString()) {
+        Integrity::auditStructureID(vm, thisValue.asCell()->structureID());
         return JSValue::encode(thisValue);
+    }
 
     auto* stringObject = jsDynamicCast<StringObject*>(vm, thisValue);