Changeset 284806 in webkit

Timestamp:

Oct 25, 2021, 12:09:53 PM (5 years ago)

Author:

Alan Coon

Message:

Cherry-pick r284506. rdar://problem/84340372

canDoFastSpread should also check that the Structure is from the global object we're watching
​https://bugs.webkit.org/show_bug.cgi?id=231976
<rdar://84340372>

Reviewed by Keith Miller.

• dfg/DFGGraph.cpp: (JSC::DFG::Graph::canDoFastSpread):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284506 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-612-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGGraph.cpp (modified) (1 diff)

branches/safari-612-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-10-25  Null  <null@apple.com>
+
+        Cherry-pick r284506. rdar://problem/84340372
+
+    canDoFastSpread should also check that the Structure is from the global object we're watching
+    https://bugs.webkit.org/show_bug.cgi?id=231976
+    <rdar://84340372>
+    
+    Reviewed by Keith Miller.
+    
+    * dfg/DFGGraph.cpp:
+    (JSC::DFG::Graph::canDoFastSpread):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284506 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-10-19  Saam Barati  <sbarati@apple.com>
+
+            canDoFastSpread should also check that the Structure is from the global object we're watching
+            https://bugs.webkit.org/show_bug.cgi?id=231976
+            <rdar://84340372>
+
+            Reviewed by Keith Miller.
+
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::canDoFastSpread):
+
 2021-10-25  Null  <null@apple.com>
 

branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -1844 +1844 @@
         return false;
 
-    ArrayPrototype* arrayPrototype = globalObjectFor(node->child1()->origin.semantic)->arrayPrototype();
+    JSGlobalObject* globalObject = globalObjectFor(node->child1()->origin.semantic);
+    ArrayPrototype* arrayPrototype = globalObject->arrayPrototype();
     bool allGood = true;
     value.m_structure.forEach([&] (RegisteredStructure structure) {
         allGood &= structure->hasMonoProto()
+            && structure->globalObject() == globalObject
             && structure->storedPrototype() == arrayPrototype
             && !structure->isDictionary()