Changeset 284757 in webkit

Timestamp:

Oct 24, 2021, 8:32:25 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

InternalFunction::createSubclassStructure() should use prototype's global object
​https://bugs.webkit.org/show_bug.cgi?id=231874

Patch by Alexey Shvayka <​ashvayka@apple.com> on 2021-10-24
Reviewed by Yusuke Suzuki.

JSTests:

• stress/internal-function-subclass-structure-realm.js: Added.

Source/JavaScriptCore:

In case NewTarget has a cross-realm "prototype" object, even though the instance
structure is created with correct Prototype, it's m_globalObject is of NewTarget's
realm instead of prototype's.

That is observable in various places, including when calling CustomAccessor, fast paths
for iteration protocol / collection constructors, isHavingABadTime() handling etc.

This patch fixes structure's global object to be correct: per spec [1], we fallback to
NewTarget's realm only if "prototype" is a primitive.

[1]: ​https://tc39.es/ecma262/#sec-getprototypefromconstructor (step 3.b)

• runtime/InternalFunction.cpp:

(JSC::InternalFunction::createSubclassStructure):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/internal-function-subclass-structure-realm.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/InternalFunction.cpp (modified) (3 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-10-24  Alexey Shvayka  <ashvayka@apple.com>
+
+        InternalFunction::createSubclassStructure() should use prototype's global object
+        https://bugs.webkit.org/show_bug.cgi?id=231874
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/internal-function-subclass-structure-realm.js: Added.
+
 2021-10-23  Phillip Mates  <pmates@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-24  Alexey Shvayka  <ashvayka@apple.com>
+
+        InternalFunction::createSubclassStructure() should use prototype's global object
+        https://bugs.webkit.org/show_bug.cgi?id=231874
+
+        Reviewed by Yusuke Suzuki.
+
+        In case NewTarget has a cross-realm "prototype" object, even though the instance
+        structure is created with correct [[Prototype]], it's m_globalObject is of NewTarget's
+        realm instead of prototype's.
+
+        That is observable in various places, including when calling CustomAccessor, fast paths
+        for iteration protocol / collection constructors, isHavingABadTime() handling etc.
+
+        This patch fixes structure's global object to be correct: per spec [1], we fallback to
+        NewTarget's realm only if "prototype" is a primitive.
+
+        [1]: https://tc39.es/ecma262/#sec-getprototypefromconstructor (step 3.b)
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+
 2021-10-22  Justin Michaud  <justin_michaud@apple.com>
 

trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp

@@ -143 +143 @@
     // newTarget may be an InternalFunction if we were called from Reflect.construct.
     JSFunction* targetFunction = jsDynamicCast<JSFunction*>(vm, newTarget);
-    JSGlobalObject* baseGlobalObject = baseClass->globalObject();
 
     if (LIKELY(targetFunction)) {
         FunctionRareData* rareData = targetFunction->ensureRareData(vm);
         Structure* structure = rareData->internalFunctionAllocationStructure();
-        if (LIKELY(structure && structure->classInfo() == baseClass->classInfo() && structure->globalObject() == baseGlobalObject))
+        if (LIKELY(structure && structure->classInfo() == baseClass->classInfo() && structure->globalObject() == baseClass->globalObject()))
             return structure;
 
@@ -155 +154 @@
         RETURN_IF_EXCEPTION(scope, nullptr);
         if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue))
-            return rareData->createInternalFunctionAllocationStructureFromBase(vm, baseGlobalObject, prototype, baseClass);
+            return rareData->createInternalFunctionAllocationStructureFromBase(vm, prototype->globalObject(vm), prototype, baseClass);
     } else {
         JSValue prototypeValue = newTarget->get(globalObject, vm.propertyNames->prototype);
@@ -162 +161 @@
             // This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.
             // Thus, we don't care about the cost of looking up the structure from our hash table every time.
-            return vm.structureCache.emptyStructureForPrototypeFromBaseStructure(baseGlobalObject, prototype, baseClass);
+            return vm.structureCache.emptyStructureForPrototypeFromBaseStructure(prototype->globalObject(vm), prototype, baseClass);
         }
     }