Changeset 262827 in webkit


Ignore:
Timestamp:
Jun 9, 2020, 5:21:56 PM (5 years ago)
Author:
mark.lam@apple.com
Message:

Disambiguate the OverridesGetPropertyNames structure flag
​https://bugs.webkit.org/show_bug.cgi?id=212909
<rdar://problem/63823557>

Reviewed by Saam Barati.

JSTests:

  • stress/unexpected-stack-overflow-below-JSObject-getPropertyNames.js: Added.

Source/JavaScriptCore:

Previously, the OverridesGetPropertyNames structure flag could mean 2 different
things:

  1. the getPropertyNames() method is overridden, or
  2. any of the forms of getPropertyName() is overridden: getPropertyName, getOwnPropertyNames, getOwnNonIndexPropertyNames

Some parts of the code expects one definition while other parts expect the other.
This patch disambiguates between the 2 by introducing OverridesAnyFormOfGetPropertyNames
for definition (2). OverridesGetPropertyNames now only means definition (1).

Note: we could have implemented overridesGetPropertyNames() by doing a comparison
of the getPropertyNames pointer in the MethodTable. This is a little slower than
checking a TypeInfo flag, but probably doesn't matter a lot in the code paths
where overridesGetPropertyNames() is called. However, we have bits in TypeInfo
left. So, we'll might as well use it.

This ambiguity resulted in JSObject::getPropertyNames() recursing infinitely
when it didn't think it could recurse. This is demonstrated in
JSTests/stress/unexpected-stack-overflow-below-JSObject-getPropertyNames.js as
follows:

  1. The test case invokes JSObject::getPropertyNames on a JSArray.
  1. In the while loop at the bottom of JSObject::getPropertynames(), we check if (prototype->structure(vm)->typeInfo().overridesGetPropertyNames()) {.
  1. The test overrides proto as follows: arg0.__proto__ = arr1 where both arg0 and arr1 are JArrays.
  1. In the old code, JSArray sets OverridesGetPropertyNames but does not override getPropertyNames(). It actually meant to set OverridesAnyFormOfGetPropertyNames (after we disambiguated it) because JSArray overrides getOwnNonIndexPropertyNames().
  1. When we get to the check at (2), we ask if the prototype overridesGetPropertyNames(). Since JSArray sets OverridesGetPropertyNames, the answer is yes / true.

JSObject::getPropertynames() then proceeds to invoke
prototype->methodTable(vm)->getPropertyNames(prototype, globalObject, propertyNames, mode);

But because JSArray does not actually overrides getPropertyNames(), we're
actually invoking JSObject::getPropertyNames() here. Viola! Infinite loop.

With this patch, JSArray is disambiguated to set OverridesAnyFormOfGetPropertyNames
instead of OverridesGetPropertyNames, and this infinite loop no longer exists.

This patch also made the following changes:

  1. Templatized TypeInfo::isSetOnFlags1() and TypeInfo::isSetOnFlags2() so that we can used static_asserts instead of a debug ASSERT to verify the integrity of the flag we're checking against.
  1. Added a Structure::validateFlags() called from the Structure constructor. validateFlags() will verify the following:
    1. OverridesGetOwnPropertySlot must be set in the flags if getOwnPropertySlot is overridden in the MethodTable.
    2. InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero must be set in the flags if getOwnPropertySlotByIndex is overridden in the MethodTable.
    3. HasPutPropertySecurityCheck must be set in the flags if doPutPropertySecurityCheck is overridden in the MethodTable.
    4. OverridesGetPropertyNames must be set in the flags if getPropertyNames is overridden in the MethodTable.
    5. OverridesAnyFormOfGetPropertyNames must be set in the flags if any of getPropertyNames, getOwnPropertyNames, or getOwnNonIndexPropertyNames are overridden in the MethodTable.

An alternate solution would be to automatically set these flags if we detect
their corresponding methods are overridden. However, this alternate solution
requires this laundry list to be checked every time a structure is constructed.
The current implementation of having the required flags already pre-determined
as a constant is more efficient in terms of performance and code space.

Also, it only takes one instantiation of the structure to verify that the flags
are valid. Since we only write JSCell / JSObject classes when we need them
and we always write tests to exercise new code (especially such classes), we're
guaranteed the flags validation will be exercised.

  1. Made JSObject::getOwnPropertySlot() and JSObject::doPutPropertySecurityCheck() not inlined when ASSERT_ENABLED. This is needed in order for Structure::validateFlags() to do its checks using function pointer comparisons. Otherwise, the inline functions can result in multiple instantiations of these functions. For example, WebCore can get its own copy of JSObject::getOwnPropertySlot() and the comparisons will think the function is overridden even when it's not.
  1. Structure::validateFlags() found the following problems which are now fixed:

GetterSetter was not using its StructureFlags. As a result, it was missing the
OverridesGetOwnPropertySlot flag.

JSDataView did not define its StructureFlags. It was missing the
OverridesGetOwnPropertySlot and OverridesAnyFormOfGetPropertyNames flags.

  1. Changed a TypeInfo constructor to not have a default argument for the flags value. Also grepped for all uses of this constructor to make sure that it is passed the StructureFlags field. This exercise found the following issue:

JSAPIValueWrapper was not using its StructureFlags when creating its structure.
Previously, it was just ignoring the StructureIsImmortal flag in StructureFlags.

  1. Hardened the assertions for hasReadOnlyOrGetterSetterPropertiesExcludingProto() and hasGetterSetterProperties() in the Structure constructor.

Previously, if the flag is set, it verifies that the ClassInfo has the
appropriate data expected by the flag. However, it does not assert the reverse
i.e. that if the ClassInfo data exists, then the flag must also be set.
The new assertions now checks both.

Moved the overridesGetCallData() assertion into Structure::validateFlags()
because it concerns the OverridesGetCallData flag. This assertion has also
ben hardened.

  • API/JSAPIValueWrapper.h:
  • API/JSCallbackObject.h:
  • debugger/DebuggerScope.h:
  • inspector/JSInjectedScriptHostPrototype.h:
  • inspector/JSJavaScriptCallFramePrototype.h:
  • runtime/ClonedArguments.h:
  • runtime/ErrorInstance.h:
  • runtime/GenericArguments.h:
  • runtime/GetterSetter.h:
  • runtime/JSArray.h:
  • runtime/JSDataView.h:
  • runtime/JSFunction.h:
  • runtime/JSGenericTypedArrayView.h:
  • runtime/JSGlobalObject.h:
  • runtime/JSLexicalEnvironment.h:
  • runtime/JSModuleEnvironment.h:
  • runtime/JSModuleNamespaceObject.h:
  • runtime/JSObject.cpp:

(JSC::JSObject::doPutPropertySecurityCheck):
(JSC::JSObject::getOwnPropertySlot):

  • runtime/JSObject.h:

(JSC::JSObject::getOwnPropertySlotImpl):
(JSC::JSObject::getOwnPropertySlot):

  • runtime/JSProxy.h:
  • runtime/JSString.h:
  • runtime/JSSymbolTableObject.h:
  • runtime/JSTypeInfo.h:

(JSC::TypeInfo::TypeInfo):
(JSC::TypeInfo::masqueradesAsUndefined const):
(JSC::TypeInfo::implementsHasInstance const):
(JSC::TypeInfo::implementsDefaultHasInstance const):
(JSC::TypeInfo::overridesGetCallData const):
(JSC::TypeInfo::overridesToThis const):
(JSC::TypeInfo::structureIsImmortal const):
(JSC::TypeInfo::overridesGetPropertyNames const):
(JSC::TypeInfo::overridesAnyFormOfGetPropertyNames const):
(JSC::TypeInfo::prohibitsPropertyCaching const):
(JSC::TypeInfo::getOwnPropertySlotIsImpure const):
(JSC::TypeInfo::getOwnPropertySlotIsImpureForPropertyAbsence const):
(JSC::TypeInfo::hasPutPropertySecurityCheck const):
(JSC::TypeInfo::newImpurePropertyFiresWatchpoints const):
(JSC::TypeInfo::isImmutablePrototypeExoticObject const):
(JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero const):
(JSC::TypeInfo::isSetOnFlags1 const):
(JSC::TypeInfo::isSetOnFlags2 const):

  • runtime/ObjectConstructor.cpp:

(JSC::objectConstructorAssign):

  • runtime/ProxyObject.h:
  • runtime/RegExpObject.h:
  • runtime/StringObject.h:
  • runtime/Structure.cpp:

(JSC::Structure::validateFlags):
(JSC::Structure::Structure):

  • runtime/Structure.h:
  • runtime/StructureInlines.h:

(JSC::Structure::canCacheOwnKeys const):

  • tools/JSDollarVM.cpp:

Source/WebCore:

  1. JSDOMWindowProperties was not defining its Base. As a result, its StructureFlags was inheriting from JSDOMObject's Base instead of from JSDOMObject as one would expect. This turns out to be harmless because JSDOMObject did not define any StructureFlags. Regardless, this is not fixed so that if JSDOMObject adds any StructureFlags, it will be inherited properly by JSDOMWindowProperties.
  1. Updated CodeGeneratorJS.pm and rebased the binding test results.
  • bindings/js/JSDOMWindowProperties.h:
  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):

  • bindings/scripts/test/JS/JSTestEventTarget.h:
  • bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.h:
  • bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.h:
  • bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.h:
  • bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h:
  • bindings/scripts/test/JS/JSTestNamedGetterCallWith.h:
  • bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedSetterThrowingException.h:
  • bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.h:
  • bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.h:
  • bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.h:
  • bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.h:
  • bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.h:
  • bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.h:
  • bindings/scripts/test/JS/JSTestObj.h:
  • bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
  • bridge/runtime_array.h:
  • bridge/runtime_object.h:

Source/WebKit:

  • WebProcess/Plugins/Netscape/JSNPObject.h:
Location:
trunk
Files:
1 added
64 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r262763 r262827  
     12020-06-09  Mark Lam  <mark.lam@apple.com>
     2
     3        Disambiguate the OverridesGetPropertyNames structure flag
     4        https://bugs.webkit.org/show_bug.cgi?id=212909
     5        <rdar://problem/63823557>
     6
     7        Reviewed by Saam Barati.
     8
     9        * stress/unexpected-stack-overflow-below-JSObject-getPropertyNames.js: Added.
     10
    1112020-06-08  Ross Kirsling  <ross.kirsling@sony.com>
    212

  • trunk/Source/JavaScriptCore/API/JSAPIValueWrapper.h

    r260415 r262827  
    22 *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
    33 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
    4  *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
     4 *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
    55 *
    66 *  This library is free software; you can redistribute it and/or
    … …  
    3434public:
    3535    using Base = JSCell;
    36     static constexpr unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
     36
     37    // OverridesAnyFormOfGetPropertyNames (which used to be OverridesGetPropertyNames) was here
     38    // since ancient times back when we pessimistically choose to apply this flag. I think we
     39    // can remove it, but we should do more testing before we do so.
     40    // Ref: http://trac.webkit.org/changeset/49694/webkit#file9
     41    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212954
     42    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesAnyFormOfGetPropertyNames | StructureIsImmortal;
    3743
    3844    template<typename CellType, SubspaceAccess mode>
    … …  
    4652    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    4753    {
    48         return Structure::create(vm, globalObject, prototype, TypeInfo(APIValueWrapperType, OverridesGetPropertyNames), info());
     54        return Structure::create(vm, globalObject, prototype, TypeInfo(APIValueWrapperType, StructureFlags), info());
    4955    }
    5056

  • trunk/Source/JavaScriptCore/API/JSCallbackObject.h

    r260744 r262827  
    11/*
    2  * Copyright (C) 2006-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006-2020 Apple Inc. All rights reserved.
    33 * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
    44 *
    … …  
    126126public:
    127127    using Base = Parent;
    128     static constexpr unsigned StructureFlags = Base::StructureFlags | ProhibitsPropertyCaching | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | ImplementsHasInstance | OverridesGetPropertyNames | OverridesGetCallData;
     128    static constexpr unsigned StructureFlags = Base::StructureFlags | ProhibitsPropertyCaching | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | ImplementsHasInstance | OverridesAnyFormOfGetPropertyNames | OverridesGetCallData;
    129129    static_assert(!(StructureFlags & ImplementsDefaultHasInstance), "using customHasInstance");
    130130

  • trunk/Source/JavaScriptCore/ChangeLog

    r262808 r262827  
     12020-06-09  Mark Lam  <mark.lam@apple.com>
     2
     3        Disambiguate the OverridesGetPropertyNames structure flag
     4        https://bugs.webkit.org/show_bug.cgi?id=212909
     5        <rdar://problem/63823557>
     6
     7        Reviewed by Saam Barati.
     8
     9        Previously, the OverridesGetPropertyNames structure flag could mean 2 different
     10        things:
     11        1. the getPropertyNames() method is overridden, or
     12        2. any of the forms of getPropertyName() is overridden:
     13           getPropertyName, getOwnPropertyNames, getOwnNonIndexPropertyNames
     14
     15        Some parts of the code expects one definition while other parts expect the other.
     16        This patch disambiguates between the 2 by introducing OverridesAnyFormOfGetPropertyNames
     17        for definition (2).  OverridesGetPropertyNames now only means definition (1).
     18
     19        Note: we could have implemented overridesGetPropertyNames() by doing a comparison
     20        of the getPropertyNames pointer in the MethodTable.  This is a little slower than
     21        checking a TypeInfo flag, but probably doesn't matter a lot in the code paths
     22        where overridesGetPropertyNames() is called.  However, we have bits in TypeInfo
     23        left.  So, we'll might as well use it.
     24
     25        This ambiguity resulted in JSObject::getPropertyNames() recursing infinitely
     26        when it didn't think it could recurse.  This is demonstrated in
     27        JSTests/stress/unexpected-stack-overflow-below-JSObject-getPropertyNames.js as
     28        follows:
     29
     30        1. The test case invokes JSObject::getPropertyNames on a JSArray.
     31
     32        2. In the while loop at the bottom of JSObject::getPropertynames(), we check
     33           `if (prototype->structure(vm)->typeInfo().overridesGetPropertyNames()) {`.
     34
     35        3. The test overrides proto as follows:
     36           `arg0.__proto__ = arr1` where both arg0 and arr1 are JArrays.
     37
     38        4. In the old code, JSArray sets OverridesGetPropertyNames but does not override
     39           getPropertyNames().  It actually meant to set OverridesAnyFormOfGetPropertyNames
     40           (after we disambiguated it) because JSArray overrides getOwnNonIndexPropertyNames().
     41
     42        5. When we get to the check at (2), we ask if the prototype overridesGetPropertyNames().
     43           Since JSArray sets OverridesGetPropertyNames, the answer is yes / true.
     44
     45           JSObject::getPropertynames() then proceeds to invoke
     46           `prototype->methodTable(vm)->getPropertyNames(prototype, globalObject, propertyNames, mode);`
     47
     48           But because JSArray does not actually overrides getPropertyNames(), we're
     49           actually invoking JSObject::getPropertyNames() here.  Viola!  Infinite loop.
     50
     51        With this patch, JSArray is disambiguated to set OverridesAnyFormOfGetPropertyNames
     52        instead of OverridesGetPropertyNames, and this infinite loop no longer exists.
     53
     54        This patch also made the following changes:
     55
     56        1. Templatized TypeInfo::isSetOnFlags1() and TypeInfo::isSetOnFlags2() so that
     57           we can used static_asserts instead of a debug ASSERT to verify the integrity of
     58           the flag we're checking against.
     59
     60        2. Added a Structure::validateFlags() called from the Structure constructor.
     61           validateFlags() will verify the following:
     62           a. OverridesGetOwnPropertySlot must be set in the flags if getOwnPropertySlot
     63              is overridden in the MethodTable.
     64           b. InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero must be set in
     65              the flags if getOwnPropertySlotByIndex is overridden in the MethodTable.
     66           c. HasPutPropertySecurityCheck must be set in the flags if doPutPropertySecurityCheck
     67              is overridden in the MethodTable.
     68           d. OverridesGetPropertyNames must be set in the flags if getPropertyNames
     69              is overridden in the MethodTable.
     70           e. OverridesAnyFormOfGetPropertyNames must be set in the flags if any of
     71              getPropertyNames, getOwnPropertyNames, or getOwnNonIndexPropertyNames are
     72              overridden in the MethodTable.
     73
     74           An alternate solution would be to automatically set these flags if we detect
     75           their corresponding methods are overridden.  However, this alternate solution
     76           requires this laundry list to be checked every time a structure is constructed.
     77           The current implementation of having the required flags already pre-determined
     78           as a constant is more efficient in terms of performance and code space.
     79
     80           Also, it only takes one instantiation of the structure to verify that the flags
     81           are valid.  Since we only write JSCell / JSObject classes when we need them
     82           and we always write tests to exercise new code (especially such classes), we're
     83           guaranteed the flags validation will be exercised.
     84
     85        3. Made JSObject::getOwnPropertySlot() and JSObject::doPutPropertySecurityCheck()
     86           not inlined when ASSERT_ENABLED.  This is needed in order for Structure::validateFlags()
     87           to do its checks using function pointer comparisons.  Otherwise, the inline
     88           functions can result in multiple instantiations of these functions.  For
     89           example, WebCore can get its own copy of JSObject::getOwnPropertySlot() and
     90           the comparisons will think the function is overridden even when it's not.
     91
     92        4. Structure::validateFlags() found the following problems which are now fixed:
     93
     94           GetterSetter was not using its StructureFlags.  As a result, it was missing the
     95           OverridesGetOwnPropertySlot flag.
     96
     97           JSDataView did not define its StructureFlags.  It was missing the
     98           OverridesGetOwnPropertySlot and OverridesAnyFormOfGetPropertyNames flags.
     99
     100        5. Changed a TypeInfo constructor to not have a default argument for the flags value.
     101           Also grepped for all uses of this constructor to make sure that it is passed
     102           the StructureFlags field.  This exercise found the following issue:
     103
     104           JSAPIValueWrapper was not using its StructureFlags when creating its structure.
     105           Previously, it was just ignoring the StructureIsImmortal flag in StructureFlags.
     106
     107        6. Hardened the assertions for hasReadOnlyOrGetterSetterPropertiesExcludingProto()
     108           and hasGetterSetterProperties() in the Structure constructor.
     109
     110           Previously, if the flag is set, it verifies that the ClassInfo has the
     111           appropriate data expected by the flag.  However, it does not assert the reverse
     112           i.e. that if the ClassInfo data exists, then the flag must also be set.
     113           The new assertions now checks both.
     114
     115           Moved the overridesGetCallData() assertion into Structure::validateFlags()
     116           because it concerns the OverridesGetCallData flag.  This assertion has also
     117           ben hardened.
     118
     119        * API/JSAPIValueWrapper.h:
     120        * API/JSCallbackObject.h:
     121        * debugger/DebuggerScope.h:
     122        * inspector/JSInjectedScriptHostPrototype.h:
     123        * inspector/JSJavaScriptCallFramePrototype.h:
     124        * runtime/ClonedArguments.h:
     125        * runtime/ErrorInstance.h:
     126        * runtime/GenericArguments.h:
     127        * runtime/GetterSetter.h:
     128        * runtime/JSArray.h:
     129        * runtime/JSDataView.h:
     130        * runtime/JSFunction.h:
     131        * runtime/JSGenericTypedArrayView.h:
     132        * runtime/JSGlobalObject.h:
     133        * runtime/JSLexicalEnvironment.h:
     134        * runtime/JSModuleEnvironment.h:
     135        * runtime/JSModuleNamespaceObject.h:
     136        * runtime/JSObject.cpp:
     137        (JSC::JSObject::doPutPropertySecurityCheck):
     138        (JSC::JSObject::getOwnPropertySlot):
     139        * runtime/JSObject.h:
     140        (JSC::JSObject::getOwnPropertySlotImpl):
     141        (JSC::JSObject::getOwnPropertySlot):
     142        * runtime/JSProxy.h:
     143        * runtime/JSString.h:
     144        * runtime/JSSymbolTableObject.h:
     145        * runtime/JSTypeInfo.h:
     146        (JSC::TypeInfo::TypeInfo):
     147        (JSC::TypeInfo::masqueradesAsUndefined const):
     148        (JSC::TypeInfo::implementsHasInstance const):
     149        (JSC::TypeInfo::implementsDefaultHasInstance const):
     150        (JSC::TypeInfo::overridesGetCallData const):
     151        (JSC::TypeInfo::overridesToThis const):
     152        (JSC::TypeInfo::structureIsImmortal const):
     153        (JSC::TypeInfo::overridesGetPropertyNames const):
     154        (JSC::TypeInfo::overridesAnyFormOfGetPropertyNames const):
     155        (JSC::TypeInfo::prohibitsPropertyCaching const):
     156        (JSC::TypeInfo::getOwnPropertySlotIsImpure const):
     157        (JSC::TypeInfo::getOwnPropertySlotIsImpureForPropertyAbsence const):
     158        (JSC::TypeInfo::hasPutPropertySecurityCheck const):
     159        (JSC::TypeInfo::newImpurePropertyFiresWatchpoints const):
     160        (JSC::TypeInfo::isImmutablePrototypeExoticObject const):
     161        (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero const):
     162        (JSC::TypeInfo::isSetOnFlags1 const):
     163        (JSC::TypeInfo::isSetOnFlags2 const):
     164        * runtime/ObjectConstructor.cpp:
     165        (JSC::objectConstructorAssign):
     166        * runtime/ProxyObject.h:
     167        * runtime/RegExpObject.h:
     168        * runtime/StringObject.h:
     169        * runtime/Structure.cpp:
     170        (JSC::Structure::validateFlags):
     171        (JSC::Structure::Structure):
     172        * runtime/Structure.h:
     173        * runtime/StructureInlines.h:
     174        (JSC::Structure::canCacheOwnKeys const):
     175        * tools/JSDollarVM.cpp:
     176
    11772020-06-09  Jonathan Bedard  <jbedard@apple.com>
    2178

  • trunk/Source/JavaScriptCore/debugger/DebuggerScope.h

    r261464 r262827  
    11/*
    2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3737public:
    3838    using Base = JSNonFinalObject;
    39     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     39    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
    4040
    4141    template<typename CellType, SubspaceAccess mode>

  • trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.h

    r258059 r262827  
    3333public:
    3434    using Base = JSC::JSNonFinalObject;
     35    // Do we really need OverridesGetOwnPropertySlot?
     36    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212956
    3537    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot;
    3638

  • trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.h

    r258224 r262827  
    3333public:
    3434    using Base = JSC::JSNonFinalObject;
     35    // Do we really need OverridesGetOwnPropertySlot?
     36    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212956
    3537    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot;
    3638

  • trunk/Source/JavaScriptCore/runtime/ClonedArguments.h

    r257399 r262827  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4141public:
    4242    using Base = JSNonFinalObject;
    43     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     43    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
    4444
    4545    template<typename CellType, SubspaceAccess mode>

  • trunk/Source/JavaScriptCore/runtime/ErrorInstance.h

    r261159 r262827  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2008-2017 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2008-2020 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    3030public:
    3131    using Base = JSNonFinalObject;
    32     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     32    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
    3333    static constexpr bool needsDestruction = true;
    3434

  • trunk/Source/JavaScriptCore/runtime/GenericArguments.h

    r257399 r262827  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3737public:
    3838    typedef JSNonFinalObject Base;
    39     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
     39    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesAnyFormOfGetPropertyNames;
    4040
    4141protected:

  • trunk/Source/JavaScriptCore/runtime/GetterSetter.h

    r257399 r262827  
    108108    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
    109109    {
    110         return Structure::create(vm, globalObject, prototype, TypeInfo(GetterSetterType), info());
     110        return Structure::create(vm, globalObject, prototype, TypeInfo(GetterSetterType, StructureFlags), info());
    111111    }
    112112

  • trunk/Source/JavaScriptCore/runtime/JSArray.h

    r258059 r262827  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    4141public:
    4242    typedef JSNonFinalObject Base;
    43     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     43    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
    4444
    4545    static size_t allocationSize(Checked<size_t> inlineCapacity)

  • trunk/Source/JavaScriptCore/runtime/JSDataView.h

    r260415 r262827  
    3434public:
    3535    using Base = JSArrayBufferView;
     36    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
     37
    3638    static constexpr unsigned elementSize = 1;
    3739

  • trunk/Source/JavaScriptCore/runtime/JSFunction.h

    r260744 r262827  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003-2019 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
    44 *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
    55 *  Copyright (C) 2007 Maks Orlovich
    … …  
    7171   
    7272    typedef JSCallee Base;
    73     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesGetCallData;
     73    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames | OverridesGetCallData;
    7474
    7575    static size_t allocationSize(Checked<size_t> inlineCapacity)

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h

    r260415 r262827  
    11/*
    2  * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    9797    typedef typename Adaptor::Type ElementType;
    9898
    99     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
     99    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesAnyFormOfGetPropertyNames | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
    100100
    101101    static constexpr unsigned elementSize = sizeof(typename Adaptor::Type);

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r262302 r262827  
    11/*
    22 *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
    3  *  Copyright (C) 2007-2019 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2007-2020 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    532532public:
    533533    using Base = JSSegmentedVariableObject;
    534     static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | IsImmutablePrototypeExoticObject;
     534    // Do we realy need OverridesAnyFormOfGetPropertyNames here?
     535    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212954
     536    static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames | IsImmutablePrototypeExoticObject;
    535537
    536538    static constexpr bool needsDestruction = true;

  • trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h

    r257399 r262827  
    11/*
    2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4949
    5050    using Base = JSSymbolTableObject;
    51     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     51    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
    5252
    5353    WriteBarrierBase<Unknown>* variables()

  • trunk/Source/JavaScriptCore/runtime/JSModuleEnvironment.h

    r259835 r262827  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4141public:
    4242    using Base = JSLexicalEnvironment;
    43     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     43    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames;
    4444
    4545    static JSModuleEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue, AbstractModuleRecord* moduleRecord)

  • trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h

    r260415 r262827  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3434public:
    3535    using Base = JSNonFinalObject;
    36     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames | GetOwnPropertySlotIsImpureForPropertyAbsence | IsImmutablePrototypeExoticObject;
     36    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesAnyFormOfGetPropertyNames | GetOwnPropertySlotIsImpureForPropertyAbsence | IsImmutablePrototypeExoticObject;
    3737
    3838    static constexpr bool needsDestruction = true;

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r261755 r262827  
    670670}
    671671
     672#if ASSERT_ENABLED
     673// These needs to be unique (not inlined) for ASSERT_ENABLED builds to enable
     674// Structure::validateFlags() to do checks using function pointer comparisons.
     675
     676bool JSObject::getOwnPropertySlot(JSObject* object, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)
     677{
     678    return getOwnPropertySlotImpl(object, globalObject, propertyName, slot);
     679}
     680
     681void JSObject::doPutPropertySecurityCheck(JSObject*, JSGlobalObject*, PropertyName, PutPropertySlot&)
     682{
     683}
     684#endif // ASSERT_ENABLED
     685
    672686// https://tc39.github.io/ecma262/#sec-ordinaryset
    673687bool ordinarySetSlow(JSGlobalObject* globalObject, JSObject* object, PropertyName propertyName, JSValue value, JSValue receiver, bool shouldThrow)

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r262628 r262827  
    9393class JSFinalObject;
    9494
     95#if ASSERT_ENABLED
     96#define JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED JS_EXPORT_PRIVATE
     97#else
     98#define JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED
     99#endif
     100
    95101class JSObject : public JSCell {
    96102    friend class BatchedTransitionOptimizer;
    … …  
    171177    template<typename CallbackWhenNoException> typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type getPropertySlot(JSGlobalObject*, PropertyName, PropertySlot&, CallbackWhenNoException) const;
    172178
    173     static bool getOwnPropertySlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);
     179private:
     180    static bool getOwnPropertySlotImpl(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);
     181public:
     182    JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED static bool getOwnPropertySlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);
     183
    174184    JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSObject*, JSGlobalObject*, unsigned propertyName, PropertySlot&);
    175185    bool getOwnPropertySlotInline(JSGlobalObject*, PropertyName, PropertySlot&);
    176     static void doPutPropertySecurityCheck(JSObject*, JSGlobalObject*, PropertyName, PutPropertySlot&);
     186    JS_EXPORT_PRIVATE_IF_ASSERT_ENABLED static void doPutPropertySecurityCheck(JSObject*, JSGlobalObject*, PropertyName, PutPropertySlot&);
    177187
    178188    // The key difference between this and getOwnPropertySlot is that getOwnPropertySlot
    … …  
    14361446// but it makes a big difference to property lookup that derived classes can inline their
    14371447// base class call to this.
    1438 ALWAYS_INLINE bool JSObject::getOwnPropertySlot(JSObject* object, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)
     1448ALWAYS_INLINE bool JSObject::getOwnPropertySlotImpl(JSObject* object, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)
    14391449{
    14401450    VM& vm = getVM(globalObject);
    … …  
    14471457}
    14481458
     1459#if !ASSERT_ENABLED
     1460ALWAYS_INLINE bool JSObject::getOwnPropertySlot(JSObject* object, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)
     1461{
     1462    return getOwnPropertySlotImpl(object, globalObject, propertyName, slot);
     1463}
     1464
    14491465ALWAYS_INLINE void JSObject::doPutPropertySecurityCheck(JSObject*, JSGlobalObject*, PropertyName, PutPropertySlot&)
    14501466{
    14511467}
     1468#endif
    14521469
    14531470// It may seem crazy to inline a function this large but it makes a big difference

  • trunk/Source/JavaScriptCore/runtime/JSProxy.h

    r257399 r262827  
    11/*
    2  * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3333public:
    3434    using Base = JSNonFinalObject;
    35     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
     35    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesAnyFormOfGetPropertyNames | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
    3636
    3737    template<typename CellType, SubspaceAccess>

  • trunk/Source/JavaScriptCore/runtime/JSString.h

    r262570 r262827  
    9090
    9191    typedef JSCell Base;
     92    // Do we really need OverridesGetOwnPropertySlot?
     93    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212956
     94    // Do we really need InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero?
     95    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212958
    9296    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | StructureIsImmortal | OverridesToThis;
    9397

  • trunk/Source/JavaScriptCore/runtime/JSSymbolTableObject.h

    r257399 r262827  
    11/*
    2  * Copyright (C) 2012-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4040public:
    4141    using Base = JSScope;
    42     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames;
     42    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesAnyFormOfGetPropertyNames;
    4343
    4444    SymbolTable* symbolTable() const { return m_symbolTable.get(); }

  • trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h

    r260331 r262827  
    5050static constexpr unsigned ImplementsHasInstance = 1 << 8;
    5151static constexpr unsigned OverridesGetPropertyNames = 1 << 9;
    52 static constexpr unsigned ProhibitsPropertyCaching = 1 << 10;
    53 static constexpr unsigned GetOwnPropertySlotIsImpure = 1 << 11;
    54 static constexpr unsigned NewImpurePropertyFiresWatchpoints = 1 << 12;
    55 static constexpr unsigned IsImmutablePrototypeExoticObject = 1 << 13;
    56 static constexpr unsigned GetOwnPropertySlotIsImpureForPropertyAbsence = 1 << 14;
    57 static constexpr unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 15;
    58 static constexpr unsigned StructureIsImmortal = 1 << 16;
    59 static constexpr unsigned HasPutPropertySecurityCheck = 1 << 17;
     52// OverridesAnyFormOfGetPropertyNames means that we cannot make assumptions about
     53// the cacheability or enumerability of property names, and therefore, we'll need
     54// to disable certain optimizations. This flag should be set if one or more of the
     55// following Object methods are overridden:
     56//     getOwnPropertyNames, getOwnNonIndexPropertyNames, getPropertyNames
     57static constexpr unsigned OverridesAnyFormOfGetPropertyNames = 1 << 10;
     58static constexpr unsigned ProhibitsPropertyCaching = 1 << 11;
     59static constexpr unsigned GetOwnPropertySlotIsImpure = 1 << 12;
     60static constexpr unsigned NewImpurePropertyFiresWatchpoints = 1 << 13;
     61static constexpr unsigned IsImmutablePrototypeExoticObject = 1 << 14;
     62static constexpr unsigned GetOwnPropertySlotIsImpureForPropertyAbsence = 1 << 15;
     63static constexpr unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 16;
     64static constexpr unsigned StructureIsImmortal = 1 << 17;
     65static constexpr unsigned HasPutPropertySecurityCheck = 1 << 18;
    6066
    6167class TypeInfo {
    … …  
    6470    typedef uint16_t OutOfLineTypeFlags;
    6571
    66     TypeInfo(JSType type, unsigned flags = 0)
     72    TypeInfo(JSType type, unsigned flags)
    6773        : TypeInfo(type, flags & 0xff, flags >> 8)
    6874    {
    … …  
    8490
    8591    unsigned flags() const { return (static_cast<unsigned>(m_flags2) << 8) | static_cast<unsigned>(m_flags); }
    86     bool masqueradesAsUndefined() const { return isSetOnFlags1(MasqueradesAsUndefined); }
    87     bool implementsHasInstance() const { return isSetOnFlags2(ImplementsHasInstance); }
    88     bool implementsDefaultHasInstance() const { return isSetOnFlags1(ImplementsDefaultHasInstance); }
    89     bool overridesGetCallData() const { return isSetOnFlags1(OverridesGetCallData); }
     92    bool masqueradesAsUndefined() const { return isSetOnFlags1<MasqueradesAsUndefined>(); }
     93    bool implementsHasInstance() const { return isSetOnFlags2<ImplementsHasInstance>(); }
     94    bool implementsDefaultHasInstance() const { return isSetOnFlags1<ImplementsDefaultHasInstance>(); }
     95    bool overridesGetCallData() const { return isSetOnFlags1<OverridesGetCallData>(); }
    9096    bool overridesGetOwnPropertySlot() const { return overridesGetOwnPropertySlot(inlineTypeFlags()); }
    9197    static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags & OverridesGetOwnPropertySlot; }
    9298    static bool hasStaticPropertyTable(InlineTypeFlags flags) { return flags & HasStaticPropertyTable; }
    9399    static bool perCellBit(InlineTypeFlags flags) { return flags & TypeInfoPerCellBit; }
    94     bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }
    95     bool structureIsImmortal() const { return isSetOnFlags2(StructureIsImmortal); }
    96     bool overridesGetPropertyNames() const { return isSetOnFlags2(OverridesGetPropertyNames); }
    97     bool prohibitsPropertyCaching() const { return isSetOnFlags2(ProhibitsPropertyCaching); }
    98     bool getOwnPropertySlotIsImpure() const { return isSetOnFlags2(GetOwnPropertySlotIsImpure); }
    99     bool getOwnPropertySlotIsImpureForPropertyAbsence() const { return isSetOnFlags2(GetOwnPropertySlotIsImpureForPropertyAbsence); }
    100     bool hasPutPropertySecurityCheck() const { return isSetOnFlags2(HasPutPropertySecurityCheck); }
    101     bool newImpurePropertyFiresWatchpoints() const { return isSetOnFlags2(NewImpurePropertyFiresWatchpoints); }
    102     bool isImmutablePrototypeExoticObject() const { return isSetOnFlags2(IsImmutablePrototypeExoticObject); }
    103     bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags2(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
     100    bool overridesToThis() const { return isSetOnFlags1<OverridesToThis>(); }
     101    bool structureIsImmortal() const { return isSetOnFlags2<StructureIsImmortal>(); }
     102    bool overridesGetPropertyNames() const { return isSetOnFlags2<OverridesGetPropertyNames>(); }
     103    bool overridesAnyFormOfGetPropertyNames() const { return isSetOnFlags2<OverridesAnyFormOfGetPropertyNames>(); }
     104    bool prohibitsPropertyCaching() const { return isSetOnFlags2<ProhibitsPropertyCaching>(); }
     105    bool getOwnPropertySlotIsImpure() const { return isSetOnFlags2<GetOwnPropertySlotIsImpure>(); }
     106    bool getOwnPropertySlotIsImpureForPropertyAbsence() const { return isSetOnFlags2<GetOwnPropertySlotIsImpureForPropertyAbsence>(); }
     107    bool hasPutPropertySecurityCheck() const { return isSetOnFlags2<HasPutPropertySecurityCheck>(); }
     108    bool newImpurePropertyFiresWatchpoints() const { return isSetOnFlags2<NewImpurePropertyFiresWatchpoints>(); }
     109    bool isImmutablePrototypeExoticObject() const { return isSetOnFlags2<IsImmutablePrototypeExoticObject>(); }
     110    bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags2<InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero>(); }
    104111
    105112    static bool isArgumentsType(JSType type)
    … …  
    132139    friend class LLIntOffsetsExtractor;
    133140
    134     bool isSetOnFlags1(unsigned flag) const { ASSERT(flag <= (1 << 7)); return m_flags & flag; }
    135     bool isSetOnFlags2(unsigned flag) const { ASSERT(flag >= (1 << 8)); return m_flags2 & (flag >> 8); }
     141    template<unsigned flag>
     142    bool isSetOnFlags1() const
     143    {
     144        static_assert(flag <= (1 << 7));
     145        return m_flags & flag;
     146    }
     147
     148    template<unsigned flag>
     149    bool isSetOnFlags2() const
     150    {
     151        static_assert(flag >= (1 << 8) && flag <= (1 << 24));
     152        return m_flags2 & (flag >> 8);
     153    }
    136154
    137155    JSType m_type;

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r261895 r262827  
    303303                if (structure->typeInfo().overridesGetOwnPropertySlot())
    304304                    return false;
    305                 if (structure->typeInfo().overridesGetPropertyNames())
     305                if (structure->typeInfo().overridesAnyFormOfGetPropertyNames())
    306306                    return false;
    307307                // FIXME: Indexed properties can be handled.

  • trunk/Source/JavaScriptCore/runtime/ProxyObject.h

    r261159 r262827  
    3535    typedef JSNonFinalObject Base;
    3636
    37     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetCallData | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames | ProhibitsPropertyCaching;
     37    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetCallData | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames | OverridesAnyFormOfGetPropertyNames | ProhibitsPropertyCaching;
    3838
    3939    template<typename CellType, SubspaceAccess mode>

  • trunk/Source/JavaScriptCore/runtime/RegExpObject.h

    r261159 r262827  
    3131public:
    3232    using Base = JSNonFinalObject;
    33     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
     33    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesAnyFormOfGetPropertyNames;
    3434
    3535    template<typename CellType, SubspaceAccess mode>

  • trunk/Source/JavaScriptCore/runtime/StringObject.h

    r261159 r262827  
    2929public:
    3030    using Base = JSWrapperObject;
    31     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
     31    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesAnyFormOfGetPropertyNames;
    3232
    3333    template<typename, SubspaceAccess mode>

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r262600 r262827  
    163163}
    164164
     165#if ASSERT_ENABLED
     166void Structure::validateFlags()
     167{
     168    const MethodTable& methodTable = m_classInfo->methodTable;
     169
     170    bool overridesGetCallData = methodTable.getCallData != JSCell::getCallData;
     171    RELEASE_ASSERT(overridesGetCallData == typeInfo().overridesGetCallData());
     172
     173    bool overridesGetOwnPropertySlot =
     174        methodTable.getOwnPropertySlot != JSObject::getOwnPropertySlot
     175        && methodTable.getOwnPropertySlot != JSCell::getOwnPropertySlot;
     176    // We can strengthen this into an equivalence test if there are no classes
     177    // that specifies this flag without overriding getOwnPropertySlot.
     178    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212956
     179    if (overridesGetOwnPropertySlot)
     180        RELEASE_ASSERT(typeInfo().overridesGetOwnPropertySlot());
     181
     182    bool overridesGetOwnPropertySlotByIndex =
     183        methodTable.getOwnPropertySlotByIndex != JSObject::getOwnPropertySlotByIndex
     184        && methodTable.getOwnPropertySlotByIndex != JSCell::getOwnPropertySlotByIndex;
     185    // We can strengthen this into an equivalence test if there are no classes
     186    // that specifies this flag without overriding getOwnPropertySlotByIndex.
     187    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212958
     188    if (overridesGetOwnPropertySlotByIndex)
     189        RELEASE_ASSERT(typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero());
     190
     191    bool overridesPutPropertySecurityCheck =
     192        methodTable.doPutPropertySecurityCheck != JSObject::doPutPropertySecurityCheck
     193        && methodTable.doPutPropertySecurityCheck != JSCell::doPutPropertySecurityCheck;
     194    RELEASE_ASSERT(overridesPutPropertySecurityCheck == typeInfo().hasPutPropertySecurityCheck());
     195
     196    bool overridesGetPropertyNames =
     197        methodTable.getPropertyNames != JSObject::getPropertyNames
     198        && methodTable.getPropertyNames != JSCell::getPropertyNames;
     199    bool overridesGetOwnPropertyNames =
     200        methodTable.getOwnPropertyNames != JSObject::getOwnPropertyNames
     201        && methodTable.getOwnPropertyNames != JSCell::getOwnPropertyNames;
     202    bool overridesGetOwnNonIndexPropertyNames =
     203        methodTable.getOwnNonIndexPropertyNames != JSObject::getOwnNonIndexPropertyNames
     204        && methodTable.getOwnNonIndexPropertyNames != JSCell::getOwnNonIndexPropertyNames;
     205
     206    RELEASE_ASSERT(overridesGetPropertyNames == typeInfo().overridesGetPropertyNames());
     207
     208    // We can strengthen this into an equivalence test if there are no classes
     209    // that specifies this flag without overriding any of the forms of getPropertyNames.
     210    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=212954
     211    if (overridesGetPropertyNames
     212        || overridesGetOwnPropertyNames
     213        || overridesGetOwnNonIndexPropertyNames)
     214        RELEASE_ASSERT(typeInfo().overridesAnyFormOfGetPropertyNames());
     215}
     216#else
     217inline void Structure::validateFlags() { }
     218#endif
     219
    165220Structure::Structure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
    166221    : JSCell(vm, vm.structureStructure.get())
    … …  
    196251    ASSERT(static_cast<PropertyOffset>(inlineCapacity) < firstOutOfLineOffset);
    197252    ASSERT(!hasRareData());
    198     ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
    199     ASSERT(hasGetterSetterProperties() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
    200     ASSERT(!this->typeInfo().overridesGetCallData() || m_classInfo->methodTable.getCallData != &JSCell::getCallData);
     253    ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() == m_classInfo->hasStaticSetterOrReadonlyProperties());
     254    ASSERT(hasGetterSetterProperties() == m_classInfo->hasStaticSetterOrReadonlyProperties());
     255
     256    validateFlags();
    201257}
    202258

  • trunk/Source/JavaScriptCore/runtime/Structure.h

    r261567 r262827  
    174174    }
    175175
     176    void validateFlags();
     177
    176178public:
    177179    StructureID id() const { return m_blob.structureID(); }

  • trunk/Source/JavaScriptCore/runtime/StructureInlines.h

    r262600 r262827  
    268268    if (hasIndexedProperties(indexingType()))
    269269        return false;
    270     if (typeInfo().overridesGetPropertyNames())
     270    if (typeInfo().overridesAnyFormOfGetPropertyNames())
    271271        return false;
    272272    return true;

  • trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp

    r262719 r262827  
    537537public:
    538538    typedef JSArray Base;
    539     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
     539    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesAnyFormOfGetPropertyNames;
    540540
    541541IGNORE_WARNINGS_BEGIN("unused-const-variable")

  • trunk/Source/WebCore/ChangeLog

    r262826 r262827  
     12020-06-09  Mark Lam  <mark.lam@apple.com>
     2
     3        Disambiguate the OverridesGetPropertyNames structure flag
     4        https://bugs.webkit.org/show_bug.cgi?id=212909
     5        <rdar://problem/63823557>
     6
     7        Reviewed by Saam Barati.
     8
     9        1. JSDOMWindowProperties was not defining its Base.  As a result, its
     10           StructureFlags was inheriting from JSDOMObject's Base instead of from JSDOMObject
     11           as one would expect.  This turns out to be harmless because JSDOMObject did not
     12           define any StructureFlags.  Regardless, this is not fixed so that if JSDOMObject
     13           adds any StructureFlags, it will be inherited properly by JSDOMWindowProperties.
     14
     15        2. Updated CodeGeneratorJS.pm and rebased the binding test results.
     16
     17        * bindings/js/JSDOMWindowProperties.h:
     18        * bindings/scripts/CodeGeneratorJS.pm:
     19        (GenerateHeader):
     20        * bindings/scripts/test/JS/JSTestEventTarget.h:
     21        * bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.h:
     22        * bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.h:
     23        * bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.h:
     24        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.h:
     25        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.h:
     26        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.h:
     27        * bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h:
     28        * bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h:
     29        * bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h:
     30        * bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h:
     31        * bindings/scripts/test/JS/JSTestNamedGetterCallWith.h:
     32        * bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.h:
     33        * bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.h:
     34        * bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.h:
     35        * bindings/scripts/test/JS/JSTestNamedSetterThrowingException.h:
     36        * bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.h:
     37        * bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.h:
     38        * bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.h:
     39        * bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.h:
     40        * bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.h:
     41        * bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.h:
     42        * bindings/scripts/test/JS/JSTestObj.h:
     43        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
     44        * bridge/runtime_array.h:
     45        * bridge/runtime_object.h:
     46
    1472020-06-09  Dean Jackson  <dino@apple.com>
    248

  • trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h

    r260992 r262827  
    3333class JSDOMWindowProperties final : public JSDOMObject {
    3434public:
     35    using Base = JSDOMObject;
     36    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::IsImmutablePrototypeExoticObject;
     37
    3538    static constexpr bool needsDestruction = false;
    3639    template<typename CellType, JSC::SubspaceAccess>
    … …  
    5861    static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::JSGlobalObject*, unsigned propertyName, JSC::PropertySlot&);
    5962
    60     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::IsImmutablePrototypeExoticObject;
    61 
    6263private:
    6364    JSDOMWindowProperties(JSC::Structure* structure, JSC::JSGlobalObject& globalObject)

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r262693 r262827  
    26862686    if (InstanceOverridesGetOwnPropertyNames($interface)) {
    26872687        push(@headerContent, "    static void getOwnPropertyNames(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyNameArray&, JSC::EnumerationMode = JSC::EnumerationMode());\n");
    2688         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;
     2688        $structureFlags{"JSC::OverridesAnyFormOfGetPropertyNames"} = 1;
    26892689    }
    26902690   

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h

    r259355 r262827  
    6767    }
    6868public:
    69     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::MasqueradesAsUndefined | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     69    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::MasqueradesAsUndefined | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    7070protected:
    7171    JSTestEventTarget(JSC::Structure*, JSDOMGlobalObject&, Ref<TestEventTarget>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6868protected:
    6969    JSTestIndexedSetterNoIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestIndexedSetterNoIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6868protected:
    6969    JSTestIndexedSetterThrowingException(JSC::Structure*, JSDOMGlobalObject&, Ref<TestIndexedSetterThrowingException>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6868protected:
    6969    JSTestIndexedSetterWithIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestIndexedSetterWithIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedAndIndexedSetterNoIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedAndIndexedSetterNoIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedAndIndexedSetterThrowingException(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedAndIndexedSetterThrowingException>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedAndIndexedSetterWithIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedAndIndexedSetterWithIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h

    r259355 r262827  
    6464    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6565public:
    66     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     66    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6767protected:
    6868    JSTestNamedDeleterNoIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedDeleterNoIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h

    r259355 r262827  
    6464    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6565public:
    66     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     66    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6767protected:
    6868    JSTestNamedDeleterThrowingException(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedDeleterThrowingException>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h

    r259355 r262827  
    6464    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6565public:
    66     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     66    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6767protected:
    6868    JSTestNamedDeleterWithIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedDeleterWithIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h

    r259355 r262827  
    6464    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6565public:
    66     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     66    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6767protected:
    6868    JSTestNamedDeleterWithIndexedGetter(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedDeleterWithIndexedGetter>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.h

    r259355 r262827  
    6262    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6363public:
    64     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     64    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6565protected:
    6666    JSTestNamedGetterCallWith(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedGetterCallWith>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.h

    r259355 r262827  
    6262    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6363public:
    64     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     64    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6565protected:
    6666    JSTestNamedGetterNoIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedGetterNoIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.h

    r259355 r262827  
    6262    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6363public:
    64     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     64    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6565protected:
    6666    JSTestNamedGetterWithIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedGetterWithIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterNoIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterNoIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterThrowingException(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterThrowingException>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterWithIdentifier(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterWithIdentifier>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterWithIndexedGetter(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterWithIndexedGetter>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterWithIndexedGetterAndSetter(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterWithIndexedGetterAndSetter>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterWithOverrideBuiltins(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterWithOverrideBuiltins>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::HasStaticPropertyTable | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::HasStaticPropertyTable | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterWithUnforgableProperties(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterWithUnforgableProperties>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.h

    r259355 r262827  
    6565    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6666public:
    67     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::HasStaticPropertyTable | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::ProhibitsPropertyCaching;
     67    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::HasStaticPropertyTable | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot | JSC::ProhibitsPropertyCaching;
    6868protected:
    6969    JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins(JSC::Structure*, JSDOMGlobalObject&, Ref<TestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h

    r260744 r262827  
    8787    JSC::JSValue testCustomReturnsOwnPromiseFunction(JSC::JSGlobalObject&, JSC::CallFrame&);
    8888public:
    89     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::HasStaticPropertyTable | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetCallData | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     89    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::HasStaticPropertyTable | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetCallData | JSC::OverridesGetOwnPropertySlot;
    9090protected:
    9191    JSTestObj(JSC::Structure*, JSDOMGlobalObject&, Ref<TestObj>&&);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h

    r259355 r262827  
    6262    static void analyzeHeap(JSCell*, JSC::HeapAnalyzer&);
    6363public:
    64     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames;
     64    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetOwnPropertySlot;
    6565protected:
    6666    JSTestOverrideBuiltins(JSC::Structure*, JSDOMGlobalObject&, Ref<TestOverrideBuiltins>&&);

  • trunk/Source/WebCore/bridge/runtime_array.h

    r260415 r262827  
    3636public:
    3737    using Base = JSArray;
    38     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
     38    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesAnyFormOfGetPropertyNames;
    3939    static constexpr bool needsDestruction = true;
    4040

  • trunk/Source/WebCore/bridge/runtime_object.h

    r260744 r262827  
    3636public:
    3737    using Base = JSNonFinalObject;
    38     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesGetCallData;
     38    static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesAnyFormOfGetPropertyNames | OverridesGetCallData;
    3939    static constexpr bool needsDestruction = true;
    4040

  • trunk/Source/WebKit/ChangeLog

    r262826 r262827  
     12020-06-09  Mark Lam  <mark.lam@apple.com>
     2
     3        Disambiguate the OverridesGetPropertyNames structure flag
     4        https://bugs.webkit.org/show_bug.cgi?id=212909
     5        <rdar://problem/63823557>
     6
     7        Reviewed by Saam Barati.
     8
     9        * WebProcess/Plugins/Netscape/JSNPObject.h:
     10
    1112020-06-09  Dean Jackson  <dino@apple.com>
    212

  • trunk/Source/WebKit/WebProcess/Plugins/Netscape/JSNPObject.h

    r260744 r262827  
    4545public:
    4646    using Base = JSC::JSDestructibleObject;
    47     static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | JSC::OverridesGetCallData;
     47    static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot | JSC::OverridesAnyFormOfGetPropertyNames | JSC::OverridesGetCallData;
    4848
    4949    template<typename CellType, JSC::SubspaceAccess>
Note: See TracChangeset for help on using the changeset viewer.