Changeset 284506 in webkit

Timestamp:

Oct 19, 2021, 3:48:26 PM (5 years ago)

Author:

sbarati@apple.com

Message:

canDoFastSpread should also check that the Structure is from the global object we're watching
​https://bugs.webkit.org/show_bug.cgi?id=231976
<rdar://84340372>

Reviewed by Keith Miller.

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::canDoFastSpread):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGGraph.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-19  Saam Barati  <sbarati@apple.com>
+
+        canDoFastSpread should also check that the Structure is from the global object we're watching
+        https://bugs.webkit.org/show_bug.cgi?id=231976
+        <rdar://84340372>
+
+        Reviewed by Keith Miller.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::canDoFastSpread):
+
 2021-10-19  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -1844 +1844 @@
         return false;
 
-    ArrayPrototype* arrayPrototype = globalObjectFor(node->child1()->origin.semantic)->arrayPrototype();
+    JSGlobalObject* globalObject = globalObjectFor(node->child1()->origin.semantic);
+    ArrayPrototype* arrayPrototype = globalObject->arrayPrototype();
     bool allGood = true;
     value.m_structure.forEach([&] (RegisteredStructure structure) {
         allGood &= structure->hasMonoProto()
+            && structure->globalObject() == globalObject
             && structure->storedPrototype() == arrayPrototype
             && !structure->isDictionary()