Changeset 273661 in webkit


Ignore:
Timestamp:
Mar 1, 2021 11:21:41 AM (17 months ago)
Author:
ysuzuki@apple.com
Message:

[JSC] Throw TypeError when getFunctionRealm hits revoked Proxy
​https://bugs.webkit.org/show_bug.cgi?id=222523

Reviewed by Alexey Shvayka.

JSTests:

  • test262/expectations.yaml:

Source/JavaScriptCore:

This patch throws TypeError when getFunctionRealm encounters revoked Proxy. However,
this makes derived structure creation code difficult to be written inlinely.
The fast path of derived structure creation must be inlined since this is critical
path of every builtin constructors.

So, this patch introduces JSC_GET_DERIVED_STRUCTURE macro which streamlines the derived
structure creation code while keeping the fast path inlined. And it inserts appropriate
error checks after this new getFunctionRealm call.

Then, we appropriately use getFunctionRealm in op_create_this implementation.

  • dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

  • runtime/AggregateErrorConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/BooleanConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/CommonSlowPaths.cpp:

(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

  • runtime/DateConstructor.cpp:

(JSC::constructDate):

  • runtime/ErrorConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/FinalizationRegistryConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

  • runtime/InternalFunction.cpp:

(JSC::getFunctionRealm):

  • runtime/InternalFunction.h:
  • runtime/IntlCollatorConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlDisplayNamesConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlListFormatConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlLocaleConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlNumberFormatConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlPluralRulesConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlRelativeTimeFormatConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/IntlSegmenterConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/JSArrayBufferConstructor.cpp:

(JSC::JSGenericArrayBufferConstructor<sharingMode>::constructImpl):

  • runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructCustomArrayBufferIfNeeded):
(JSC::constructGenericTypedArrayViewImpl):

  • runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::errorStructureWithErrorType const):
(JSC::JSGlobalObject::arrayBufferStructureWithSharingMode const):
(JSC::JSGlobalObject::typedArrayStructureWithTypedArrayType const):

  • runtime/JSGlobalObjectInlines.h:

(JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation const):

  • runtime/MapConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/NativeErrorConstructor.cpp:

(JSC::NativeErrorConstructor<errorType>::constructImpl):

  • runtime/NumberConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/ObjectConstructor.cpp:

(JSC::constructObjectWithNewTarget):

  • runtime/ProxyConstructor.cpp:

(JSC::ProxyConstructor::create):
(JSC::ProxyConstructor::finishCreation):

  • runtime/ProxyConstructor.h:
  • runtime/RegExpConstructor.cpp:

(JSC::getRegExpStructure):

  • runtime/SetConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/StringConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/WeakMapConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/WeakObjectRefConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • runtime/WeakSetConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyCompileErrorConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyGlobalConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyInstanceConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyLinkErrorConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyMemoryConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyModuleConstructor.cpp:

(JSC::WebAssemblyModuleConstructor::createModule):

  • wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

  • wasm/js/WebAssemblyTableConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

Source/WebCore:

  • bindings/js/JSDOMWrapperCache.h:

(WebCore::setSubclassStructureIfNeeded):

  • bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement):

Location:
trunk
Files:
49 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r273641 r273661  
     12021-03-01  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Throw TypeError when getFunctionRealm hits revoked Proxy
     4        https://bugs.webkit.org/show_bug.cgi?id=222523
     5
     6        Reviewed by Alexey Shvayka.
     7
     8        * test262/expectations.yaml:
     9
    1102021-02-28  Yusuke Suzuki  <ysuzuki@apple.com>
    211

  • trunk/JSTests/test262/expectations.yaml

    r273634 r273661  
    610610  default: 'Test262Error: Expected a TypeError but got a TypeError'
    611611  strict mode: 'Test262Error: Expected a TypeError but got a TypeError'
    612 test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
    613   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    614   strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    615 test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy.js:
    616   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    617   strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    618612test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
    619613  default: 'Test262Error: Expected a TypeError but got a TypeError'

  • trunk/Source/JavaScriptCore/ChangeLog

    r273649 r273661  
     12021-03-01  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Throw TypeError when getFunctionRealm hits revoked Proxy
     4        https://bugs.webkit.org/show_bug.cgi?id=222523
     5
     6        Reviewed by Alexey Shvayka.
     7
     8        This patch throws TypeError when getFunctionRealm encounters revoked Proxy. However,
     9        this makes derived structure creation code difficult to be written inlinely.
     10        The fast path of derived structure creation must be inlined since this is critical
     11        path of every builtin constructors.
     12
     13        So, this patch introduces JSC_GET_DERIVED_STRUCTURE macro which streamlines the derived
     14        structure creation code while keeping the fast path inlined. And it inserts appropriate
     15        error checks after this new getFunctionRealm call.
     16
     17        Then, we appropriately use getFunctionRealm in op_create_this implementation.
     18
     19        * dfg/DFGOperations.cpp:
     20        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
     21        * runtime/AggregateErrorConstructor.cpp:
     22        (JSC::JSC_DEFINE_HOST_FUNCTION):
     23        * runtime/BooleanConstructor.cpp:
     24        (JSC::JSC_DEFINE_HOST_FUNCTION):
     25        * runtime/CommonSlowPaths.cpp:
     26        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
     27        * runtime/DateConstructor.cpp:
     28        (JSC::constructDate):
     29        * runtime/ErrorConstructor.cpp:
     30        (JSC::JSC_DEFINE_HOST_FUNCTION):
     31        * runtime/FinalizationRegistryConstructor.cpp:
     32        (JSC::JSC_DEFINE_HOST_FUNCTION):
     33        * runtime/FunctionConstructor.cpp:
     34        (JSC::constructFunctionSkippingEvalEnabledCheck):
     35        * runtime/InternalFunction.cpp:
     36        (JSC::getFunctionRealm):
     37        * runtime/InternalFunction.h:
     38        * runtime/IntlCollatorConstructor.cpp:
     39        (JSC::JSC_DEFINE_HOST_FUNCTION):
     40        * runtime/IntlDateTimeFormatConstructor.cpp:
     41        (JSC::JSC_DEFINE_HOST_FUNCTION):
     42        * runtime/IntlDisplayNamesConstructor.cpp:
     43        (JSC::JSC_DEFINE_HOST_FUNCTION):
     44        * runtime/IntlListFormatConstructor.cpp:
     45        (JSC::JSC_DEFINE_HOST_FUNCTION):
     46        * runtime/IntlLocaleConstructor.cpp:
     47        (JSC::JSC_DEFINE_HOST_FUNCTION):
     48        * runtime/IntlNumberFormatConstructor.cpp:
     49        (JSC::JSC_DEFINE_HOST_FUNCTION):
     50        * runtime/IntlPluralRulesConstructor.cpp:
     51        (JSC::JSC_DEFINE_HOST_FUNCTION):
     52        * runtime/IntlRelativeTimeFormatConstructor.cpp:
     53        (JSC::JSC_DEFINE_HOST_FUNCTION):
     54        * runtime/IntlSegmenterConstructor.cpp:
     55        (JSC::JSC_DEFINE_HOST_FUNCTION):
     56        * runtime/JSArrayBufferConstructor.cpp:
     57        (JSC::JSGenericArrayBufferConstructor<sharingMode>::constructImpl):
     58        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
     59        (JSC::constructCustomArrayBufferIfNeeded):
     60        (JSC::constructGenericTypedArrayViewImpl):
     61        * runtime/JSGlobalObject.h:
     62        (JSC::JSGlobalObject::errorStructureWithErrorType const):
     63        (JSC::JSGlobalObject::arrayBufferStructureWithSharingMode const):
     64        (JSC::JSGlobalObject::typedArrayStructureWithTypedArrayType const):
     65        * runtime/JSGlobalObjectInlines.h:
     66        (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation const):
     67        * runtime/MapConstructor.cpp:
     68        (JSC::JSC_DEFINE_HOST_FUNCTION):
     69        * runtime/NativeErrorConstructor.cpp:
     70        (JSC::NativeErrorConstructor<errorType>::constructImpl):
     71        * runtime/NumberConstructor.cpp:
     72        (JSC::JSC_DEFINE_HOST_FUNCTION):
     73        * runtime/ObjectConstructor.cpp:
     74        (JSC::constructObjectWithNewTarget):
     75        * runtime/ProxyConstructor.cpp:
     76        (JSC::ProxyConstructor::create):
     77        (JSC::ProxyConstructor::finishCreation):
     78        * runtime/ProxyConstructor.h:
     79        * runtime/RegExpConstructor.cpp:
     80        (JSC::getRegExpStructure):
     81        * runtime/SetConstructor.cpp:
     82        (JSC::JSC_DEFINE_HOST_FUNCTION):
     83        * runtime/StringConstructor.cpp:
     84        (JSC::JSC_DEFINE_HOST_FUNCTION):
     85        * runtime/WeakMapConstructor.cpp:
     86        (JSC::JSC_DEFINE_HOST_FUNCTION):
     87        * runtime/WeakObjectRefConstructor.cpp:
     88        (JSC::JSC_DEFINE_HOST_FUNCTION):
     89        * runtime/WeakSetConstructor.cpp:
     90        (JSC::JSC_DEFINE_HOST_FUNCTION):
     91        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
     92        (JSC::JSC_DEFINE_HOST_FUNCTION):
     93        * wasm/js/WebAssemblyGlobalConstructor.cpp:
     94        (JSC::JSC_DEFINE_HOST_FUNCTION):
     95        * wasm/js/WebAssemblyInstanceConstructor.cpp:
     96        (JSC::JSC_DEFINE_HOST_FUNCTION):
     97        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
     98        (JSC::JSC_DEFINE_HOST_FUNCTION):
     99        * wasm/js/WebAssemblyMemoryConstructor.cpp:
     100        (JSC::JSC_DEFINE_HOST_FUNCTION):
     101        * wasm/js/WebAssemblyModuleConstructor.cpp:
     102        (JSC::WebAssemblyModuleConstructor::createModule):
     103        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
     104        (JSC::JSC_DEFINE_HOST_FUNCTION):
     105        * wasm/js/WebAssemblyTableConstructor.cpp:
     106        (JSC::JSC_DEFINE_HOST_FUNCTION):
     107
    11082021-03-01  Alexey Shvayka  <shvaikalesh@gmail.com>
    2109

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r272938 r273661  
    331331    if (proto.isObject())
    332332        return constructEmptyObject(globalObject, asObject(proto));
    333     return constructEmptyObject(globalObject);
     333    JSGlobalObject* functionGlobalObject = getFunctionRealm(globalObject, constructor);
     334    RETURN_IF_EXCEPTION(scope, nullptr);
     335    return constructEmptyObject(functionGlobalObject);
    334336}
    335337
    … …  
    340342    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    341343    auto scope = DECLARE_THROW_SCOPE(vm);
    342     Structure* structure = constructor == globalObject->promiseConstructor()
    343         ? globalObject->promiseStructure()
    344         : InternalFunction::createSubclassStructure(globalObject, constructor, getFunctionRealm(vm, constructor)->promiseStructure());
     344    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, promiseStructure, constructor, globalObject->promiseConstructor());
    345345    RETURN_IF_EXCEPTION(scope, nullptr);
    346346    RELEASE_AND_RETURN(scope, JSPromise::create(vm, structure));
    … …  
    353353    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    354354    auto scope = DECLARE_THROW_SCOPE(vm);
    355     Structure* structure = constructor == globalObject->internalPromiseConstructor()
    356         ? globalObject->internalPromiseStructure()
    357         : InternalFunction::createSubclassStructure(globalObject, constructor, getFunctionRealm(vm, constructor)->internalPromiseStructure());
     355    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, internalPromiseStructure, constructor, globalObject->internalPromiseConstructor());
    358356    RETURN_IF_EXCEPTION(scope, nullptr);
    359357    RELEASE_AND_RETURN(scope, JSInternalPromise::create(vm, structure));

  • trunk/Source/JavaScriptCore/runtime/AggregateErrorConstructor.cpp

    r267594 r273661  
    7373
    7474    JSObject* newTarget = asObject(callFrame->newTarget());
    75     Structure* errorStructure = newTarget == callFrame->jsCallee()
    76         ? globalObject->errorStructure(ErrorType::AggregateError)
    77         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->errorStructure(ErrorType::AggregateError));
     75    Structure* errorStructure = JSC_GET_DERIVED_STRUCTURE(vm, errorStructureWithErrorType<ErrorType::AggregateError>, newTarget, callFrame->jsCallee());
    7876    RETURN_IF_EXCEPTION(scope, { });
    7977    ASSERT(errorStructure);

  • trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp

    r267594 r273661  
    4848
    4949    JSObject* newTarget = asObject(callFrame->newTarget());
    50     Structure* booleanStructure = newTarget == callFrame->jsCallee()
    51         ? globalObject->booleanObjectStructure()
    52         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->booleanObjectStructure());
     50    Structure* booleanStructure = JSC_GET_DERIVED_STRUCTURE(vm, booleanObjectStructure, newTarget, callFrame->jsCallee());
    5351    RETURN_IF_EXCEPTION(scope, { });
    5452

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r273217 r273661  
    247247        }
    248248    } else {
    249         // http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor
     249        // https://tc39.es/ecma262/#sec-getprototypefromconstructor
    250250        JSValue proto = constructorAsObject->get(globalObject, vm.propertyNames->prototype);
    251251        CHECK_EXCEPTION();
    252252        if (proto.isObject())
    253253            result = constructEmptyObject(globalObject, asObject(proto));
    254         else
    255             result = constructEmptyObject(globalObject);
     254        else {
     255            JSGlobalObject* functionGlobalObject = getFunctionRealm(globalObject, constructorAsObject);
     256            CHECK_EXCEPTION();
     257            result = constructEmptyObject(functionGlobalObject);
     258        }
    256259    }
    257260    RETURN(result);
    … …  
    266269    JSPromise* result = nullptr;
    267270    if (bytecode.m_isInternalPromise) {
    268         Structure* structure = constructorAsObject == globalObject->internalPromiseConstructor()
    269             ? globalObject->internalPromiseStructure()
    270             : InternalFunction::createSubclassStructure(globalObject, constructorAsObject, getFunctionRealm(vm, constructorAsObject)->internalPromiseStructure());
     271        Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, internalPromiseStructure, constructorAsObject, globalObject->internalPromiseConstructor());
    271272        CHECK_EXCEPTION();
    272273        result = JSInternalPromise::create(vm, structure);
    273274    } else {
    274         Structure* structure = constructorAsObject == globalObject->promiseConstructor()
    275             ? globalObject->promiseStructure()
    276             : InternalFunction::createSubclassStructure(globalObject, constructorAsObject, getFunctionRealm(vm, constructorAsObject)->promiseStructure());
     275        Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, promiseStructure, constructorAsObject, globalObject->promiseConstructor());
    277276        CHECK_EXCEPTION();
    278277        result = JSPromise::create(vm, structure);

  • trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp

    r270861 r273661  
    128128    RETURN_IF_EXCEPTION(scope, nullptr);
    129129
    130     Structure* dateStructure = !newTarget || newTarget == globalObject->dateConstructor()
    131         ? globalObject->dateStructure()
    132         : InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), getFunctionRealm(vm, asObject(newTarget))->dateStructure());
    133     RETURN_IF_EXCEPTION(scope, nullptr);
     130    Structure* dateStructure = nullptr;
     131    if (!newTarget)
     132        dateStructure = globalObject->dateStructure();
     133    else {
     134        dateStructure = JSC_GET_DERIVED_STRUCTURE(vm, dateStructure, asObject(newTarget), globalObject->dateConstructor());
     135        RETURN_IF_EXCEPTION(scope, nullptr);
     136    }
    134137
    135138    return DateInstance::create(vm, dateStructure, value);

  • trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp

    r273203 r273661  
    5656
    5757    JSObject* newTarget = asObject(callFrame->newTarget());
    58     Structure* errorStructure = newTarget == callFrame->jsCallee()
    59         ? globalObject->errorStructure()
    60         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->errorStructure());
     58    Structure* errorStructure = JSC_GET_DERIVED_STRUCTURE(vm, errorStructure, newTarget, callFrame->jsCallee());
    6159    RETURN_IF_EXCEPTION(scope, { });
    6260

  • trunk/Source/JavaScriptCore/runtime/FinalizationRegistryConstructor.cpp

    r267594 r273661  
    7070
    7171    JSObject* newTarget = asObject(callFrame->newTarget());
    72     Structure* finalizationRegistryStructure = callFrame->jsCallee() == newTarget
    73         ? globalObject->finalizationRegistryStructure()
    74         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->finalizationRegistryStructure());
     72    Structure* finalizationRegistryStructure = JSC_GET_DERIVED_STRUCTURE(vm, finalizationRegistryStructure, newTarget, callFrame->jsCallee());
    7573    RETURN_IF_EXCEPTION(scope, encodedJSValue());
    7674    RELEASE_AND_RETURN(scope, JSValue::encode(JSFinalizationRegistry::create(vm, finalizationRegistryStructure, callFrame->uncheckedArgument(0).getObject())));

  • trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp

    r267594 r273661  
    160160    }
    161161
     162    JSGlobalObject* structureGlobalObject = globalObject;
    162163    bool needsSubclassStructure = newTarget && newTarget != globalObject->functionConstructor();
    163     JSGlobalObject* structureGlobalObject = needsSubclassStructure ? getFunctionRealm(vm, asObject(newTarget)) : globalObject;
     164    if (needsSubclassStructure) {
     165        structureGlobalObject = getFunctionRealm(globalObject, asObject(newTarget));
     166        RETURN_IF_EXCEPTION(scope, nullptr);
     167    }
    164168    Structure* structure = nullptr;
    165169    switch (functionConstructionMode) {

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp

    r273138 r273661  
    173173
    174174// https://tc39.es/ecma262/#sec-getfunctionrealm
    175 JSGlobalObject* getFunctionRealm(VM& vm, JSObject* object)
    176 {
     175JSGlobalObject* getFunctionRealm(JSGlobalObject* globalObject, JSObject* object)
     176{
     177    VM& vm = globalObject->vm();
     178    auto scope = DECLARE_THROW_SCOPE(vm);
     179
    177180    ASSERT(object->isCallable(vm));
    178181
    … …  
    185188        if (object->type() == ProxyObjectType) {
    186189            auto* proxy = jsCast<ProxyObject*>(object);
    187             // Per step 4.a, a TypeError should be thrown for revoked Proxy, yet we skip it since:
    188             // a) It is barely observable anyway: "prototype" lookup in createSubclassStructure() will throw for revoked Proxy.
    189             // b) Throwing getFunctionRealm() will restrict calling it inline as an argument of createSubclassStructure().
    190             // c) There is ongoing discussion on removing it: https://github.com/tc39/ecma262/issues/1798.
    191             if (!proxy->isRevoked()) {
    192                 object = proxy->target();
    193                 continue;
     190            if (proxy->isRevoked()) {
     191                throwTypeError(globalObject, scope, "Cannot get function realm from revoked Proxy"_s);
     192                return nullptr;
    194193            }
     194            object = proxy->target();
     195            continue;
    195196        }
    196197

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.h

    r273138 r273661  
    9999};
    100100
    101 JS_EXPORT_PRIVATE JSGlobalObject* getFunctionRealm(VM&, JSObject*);
     101JS_EXPORT_PRIVATE JSGlobalObject* getFunctionRealm(JSGlobalObject*, JSObject*);
     102
     103#define JSC_GET_DERIVED_STRUCTURE(vm, structureMemberFunctionName, newTarget, constructor) \
     104    ((newTarget) == (constructor) \
     105        ? globalObject->structureMemberFunctionName() \
     106        : ([&]() -> Structure* { \
     107            auto scope = DECLARE_THROW_SCOPE((vm)); \
     108            auto* functionGlobalObject = getFunctionRealm(globalObject, (newTarget)); \
     109            RETURN_IF_EXCEPTION(scope, nullptr); \
     110            RELEASE_AND_RETURN(scope, InternalFunction::createSubclassStructure(globalObject, (newTarget), functionGlobalObject->structureMemberFunctionName())); \
     111        }()))
    102112
    103113} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp

    r267594 r273661  
    9090    // 3. ReturnIfAbrupt(collator).
    9191    JSObject* newTarget = asObject(callFrame->newTarget());
    92     Structure* structure = newTarget == callFrame->jsCallee()
    93         ? globalObject->collatorStructure()
    94         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->collatorStructure());
     92    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, collatorStructure, newTarget, callFrame->jsCallee());
    9593    RETURN_IF_EXCEPTION(scope, { });
    9694

  • trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp

    r267594 r273661  
    8888    // 3. ReturnIfAbrupt(dateTimeFormat).
    8989    JSObject* newTarget = asObject(callFrame->newTarget());
    90     Structure* structure = newTarget == callFrame->jsCallee()
    91         ? globalObject->dateTimeFormatStructure()
    92         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->dateTimeFormatStructure());
     90    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, dateTimeFormatStructure, newTarget, callFrame->jsCallee());
    9391    RETURN_IF_EXCEPTION(scope, { });
    9492

  • trunk/Source/JavaScriptCore/runtime/IntlDisplayNamesConstructor.cpp

    r267594 r273661  
    8585
    8686    JSObject* newTarget = asObject(callFrame->newTarget());
    87     Structure* structure = newTarget == callFrame->jsCallee()
    88         ? globalObject->displayNamesStructure()
    89         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->displayNamesStructure());
     87    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, displayNamesStructure, newTarget, callFrame->jsCallee());
    9088    RETURN_IF_EXCEPTION(scope, { });
    9189

  • trunk/Source/JavaScriptCore/runtime/IntlListFormatConstructor.cpp

    r268956 r273661  
    8585
    8686    JSObject* newTarget = asObject(callFrame->newTarget());
    87     Structure* structure = newTarget == callFrame->jsCallee()
    88         ? globalObject->listFormatStructure()
    89         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->listFormatStructure());
     87    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, listFormatStructure, newTarget, callFrame->jsCallee());
    9088    RETURN_IF_EXCEPTION(scope, { });
    9189

  • trunk/Source/JavaScriptCore/runtime/IntlLocaleConstructor.cpp

    r267594 r273661  
    7171
    7272    JSObject* newTarget = asObject(callFrame->newTarget());
    73     Structure* structure = newTarget == callFrame->jsCallee()
    74         ? globalObject->localeStructure()
    75         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->localeStructure());
     73    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, localeStructure, newTarget, callFrame->jsCallee());
    7674    RETURN_IF_EXCEPTION(scope, { });
    7775

  • trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp

    r267594 r273661  
    8888    // 3. ReturnIfAbrupt(numberFormat).
    8989    JSObject* newTarget = asObject(callFrame->newTarget());
    90     Structure* structure = newTarget == callFrame->jsCallee()
    91         ? globalObject->numberFormatStructure()
    92         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->numberFormatStructure());
     90    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, numberFormatStructure, newTarget, callFrame->jsCallee());
    9391    RETURN_IF_EXCEPTION(scope, { });
    9492

  • trunk/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.cpp

    r267594 r273661  
    8888    // https://tc39.github.io/ecma402/#sec-intl.pluralrules
    8989    JSObject* newTarget = asObject(callFrame->newTarget());
    90     Structure* structure = newTarget == callFrame->jsCallee()
    91         ? globalObject->pluralRulesStructure()
    92         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->pluralRulesStructure());
     90    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, pluralRulesStructure, newTarget, callFrame->jsCallee());
    9391    RETURN_IF_EXCEPTION(scope, { });
    9492

  • trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatConstructor.cpp

    r267594 r273661  
    8686
    8787    JSObject* newTarget = asObject(callFrame->newTarget());
    88     Structure* structure = newTarget == callFrame->jsCallee()
    89         ? globalObject->relativeTimeFormatStructure()
    90         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->relativeTimeFormatStructure());
     88    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, relativeTimeFormatStructure, newTarget, callFrame->jsCallee());
    9189    RETURN_IF_EXCEPTION(scope, { });
    9290

  • trunk/Source/JavaScriptCore/runtime/IntlSegmenterConstructor.cpp

    r267594 r273661  
    8585
    8686    JSObject* newTarget = asObject(callFrame->newTarget());
    87     Structure* structure = newTarget == callFrame->jsCallee()
    88         ? globalObject->segmenterStructure()
    89         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->segmenterStructure());
     87    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, segmenterStructure, newTarget, callFrame->jsCallee());
    9088    RETURN_IF_EXCEPTION(scope, { });
    9189

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp

    r270552 r273661  
    7979
    8080    JSObject* newTarget = asObject(callFrame->newTarget());
    81     Structure* arrayBufferStructure = newTarget == callFrame->jsCallee()
    82         ? globalObject->arrayBufferStructure(sharingMode)
    83         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->arrayBufferStructure(sharingMode));
     81    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, arrayBufferStructureWithSharingMode<sharingMode>, newTarget, callFrame->jsCallee());
    8482    RETURN_IF_EXCEPTION(scope, { });
    8583
    … …  
    103101    ASSERT(sharingMode == buffer->sharingMode());
    104102
    105     JSArrayBuffer* result = JSArrayBuffer::create(vm, arrayBufferStructure, WTFMove(buffer));
     103    JSArrayBuffer* result = JSArrayBuffer::create(vm, structure, WTFMove(buffer));
    106104    return JSValue::encode(result);
    107105}

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h

    r272170 r273661  
    135135    }
    136136
    137     auto result = JSArrayBuffer::create(vm, getFunctionRealm(vm, asObject(species.value()))->arrayBufferStructure(ArrayBufferSharingMode::Default), WTFMove(buffer));
     137    JSGlobalObject* functionGlobalObject = getFunctionRealm(globalObject, asObject(species.value()));
     138    RETURN_IF_EXCEPTION(scope, nullptr);
     139    auto result = JSArrayBuffer::create(vm, functionGlobalObject->arrayBufferStructure(ArrayBufferSharingMode::Default), WTFMove(buffer));
    138140    if (prototype.isObject())
    139141        result->setPrototypeDirect(vm, prototype);
    … …  
    261263
    262264    JSObject* newTarget = asObject(callFrame->newTarget());
    263     Structure* structure = newTarget == callFrame->jsCallee()
    264         ? globalObject->typedArrayStructure(ViewClass::TypedArrayStorageType)
    265         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->typedArrayStructure(ViewClass::TypedArrayStorageType));
     265    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, typedArrayStructureWithTypedArrayType<ViewClass::TypedArrayStorageType>, newTarget, callFrame->jsCallee());
    266266    RETURN_IF_EXCEPTION(scope, { });
    267267

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r273225 r273661  
    787787        return nullptr;
    788788    }
     789    template<ErrorType errorType> Structure* errorStructureWithErrorType() const { return errorStructure(errorType); }
     790
    789791    Structure* calleeStructure() const { return m_calleeStructure.get(); }
    790792    Structure* hostFunctionStructure() const { return m_hostFunctionStructure.get(); }
    … …  
    916918        return nullptr;
    917919    }
     920    template<ArrayBufferSharingMode sharingMode> Structure* arrayBufferStructureWithSharingMode() const { return arrayBufferStructure(sharingMode); }
    918921    JSObject* arrayBufferConstructor(ArrayBufferSharingMode sharingMode) const
    919922    {
    … …  
    979982        return typedArrayStructureConcurrently(type) == structure;
    980983    }
     984    template<TypedArrayType type> Structure* typedArrayStructureWithTypedArrayType() const { return typedArrayStructure(type); }
    981985
    982986    JSObject* typedArrayConstructor(TypedArrayType type) const

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h

    r260732 r273661  
    102102ALWAYS_INLINE Structure* JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation(JSGlobalObject* globalObject, IndexingType indexingType, JSValue newTarget) const
    103103{
    104     return !newTarget || newTarget == globalObject->arrayConstructor()
    105         ? globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)
    106         : InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), getFunctionRealm(globalObject->vm(), asObject(newTarget))->arrayStructureForIndexingTypeDuringAllocation(indexingType));
     104    VM& vm = globalObject->vm();
     105    auto scope = DECLARE_THROW_SCOPE(vm);
     106    if (!newTarget || newTarget == globalObject->arrayConstructor())
     107        return globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType);
     108    auto* functionGlobalObject = getFunctionRealm(globalObject, asObject(newTarget));
     109    RETURN_IF_EXCEPTION(scope, nullptr);
     110    RELEASE_AND_RETURN(scope, InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), functionGlobalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)));
    107111}
    108112

  • trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp

    r267594 r273661  
    6464
    6565    JSObject* newTarget = asObject(callFrame->newTarget());
    66     Structure* mapStructure = newTarget == callFrame->jsCallee()
    67         ? globalObject->mapStructure()
    68         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->mapStructure());
     66    Structure* mapStructure = JSC_GET_DERIVED_STRUCTURE(vm, mapStructure, newTarget, callFrame->jsCallee());
    6967    RETURN_IF_EXCEPTION(scope, { });
    7068

  • trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp

    r273203 r273661  
    5353
    5454    JSObject* newTarget = asObject(callFrame->newTarget());
    55     Structure* errorStructure = newTarget == callFrame->jsCallee()
    56         ? globalObject->errorStructure(errorType)
    57         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->errorStructure(errorType));
     55    Structure* errorStructure = JSC_GET_DERIVED_STRUCTURE(vm, errorStructureWithErrorType<errorType>, newTarget, callFrame->jsCallee());
    5856    RETURN_IF_EXCEPTION(scope, { });
    59     ASSERT(errorStructure);
    60 
    6157    RELEASE_AND_RETURN(scope, JSValue::encode(ErrorInstance::create(globalObject, errorStructure, message, nullptr, TypeNothing, errorType, false)));
    6258}

  • trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp

    r267594 r273661  
    102102
    103103    JSObject* newTarget = asObject(callFrame->newTarget());
    104     Structure* structure = newTarget == callFrame->jsCallee()
    105         ? globalObject->numberObjectStructure()
    106         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->numberObjectStructure());
     104    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, numberObjectStructure, newTarget, callFrame->jsCallee());
    107105    RETURN_IF_EXCEPTION(scope, { });
    108106

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r272938 r273661  
    115115    if (newTarget && newTarget != objectConstructor) {
    116116        // a. Return ? OrdinaryCreateFromConstructor(NewTarget, "%ObjectPrototype%").
    117         Structure* baseStructure = getFunctionRealm(vm, asObject(newTarget))->objectStructureForObjectConstructor();
     117        JSGlobalObject* functionGlobalObject = getFunctionRealm(globalObject, asObject(newTarget));
     118        RETURN_IF_EXCEPTION(scope, nullptr);
     119        Structure* baseStructure = functionGlobalObject->objectStructureForObjectConstructor();
    118120        Structure* objectStructure = InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), baseStructure);
    119121        RETURN_IF_EXCEPTION(scope, nullptr);

  • trunk/Source/JavaScriptCore/runtime/ProxyConstructor.cpp

    r267594 r273661  
    4141{
    4242    ProxyConstructor* constructor = new (NotNull, allocateCell<ProxyConstructor>(vm.heap)) ProxyConstructor(vm, structure);
    43     constructor->finishCreation(vm, "Proxy", structure->globalObject());
     43    constructor->finishCreation(vm, structure->globalObject());
    4444    return constructor;
    4545}
    … …  
    7575}
    7676
    77 void ProxyConstructor::finishCreation(VM& vm, const char* name, JSGlobalObject* globalObject)
     77void ProxyConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject)
    7878{
    79     Base::finishCreation(vm, 2, name, PropertyAdditionMode::WithStructureTransition);
    80     putDirect(vm, makeIdentifier(vm, "revocable"), JSFunction::create(vm, globalObject, 2, "revocable"_s, makeRevocableProxy));
     79    Base::finishCreation(vm, 2, "Proxy", PropertyAdditionMode::WithoutStructureTransition);
     80    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("revocable", makeRevocableProxy, static_cast<unsigned>(PropertyAttribute::DontEnum), 2);
    8181}
    8282

  • trunk/Source/JavaScriptCore/runtime/ProxyConstructor.h

    r253019 r273661  
    4444    }
    4545
    46     void finishCreation(VM&, const char* name, JSGlobalObject*);
     46    void finishCreation(VM&, JSGlobalObject*);
    4747
    4848private:

  • trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp

    r267727 r273661  
    213213inline Structure* getRegExpStructure(JSGlobalObject* globalObject, JSValue newTarget)
    214214{
    215     return !newTarget || newTarget == globalObject->regExpConstructor()
    216         ? globalObject->regExpStructure()
    217         : InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), getFunctionRealm(globalObject->vm(), asObject(newTarget))->regExpStructure());
     215    if (!newTarget)
     216        return globalObject->regExpStructure();
     217    VM& vm = globalObject->vm();
     218    return JSC_GET_DERIVED_STRUCTURE(vm, regExpStructure, asObject(newTarget), globalObject->regExpConstructor());
    218219}
    219220

  • trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp

    r267594 r273661  
    6464
    6565    JSObject* newTarget = asObject(callFrame->newTarget());
    66     Structure* setStructure = newTarget == callFrame->jsCallee()
    67         ? globalObject->setStructure()
    68         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->setStructure());
     66    Structure* setStructure = JSC_GET_DERIVED_STRUCTURE(vm, setStructure, newTarget, callFrame->jsCallee());
    6967    RETURN_IF_EXCEPTION(scope, { });
    7068

  • trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp

    r267594 r273661  
    141141
    142142    JSObject* newTarget = asObject(callFrame->newTarget());
    143     Structure* structure = newTarget == callFrame->jsCallee()
    144         ? globalObject->stringObjectStructure()
    145         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->stringObjectStructure());
     143    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, stringObjectStructure, newTarget, callFrame->jsCallee());
    146144    RETURN_IF_EXCEPTION(scope, { });
    147145

  • trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp

    r267594 r273661  
    6363
    6464    JSObject* newTarget = asObject(callFrame->newTarget());
    65     Structure* weakMapStructure = newTarget == callFrame->jsCallee()
    66         ? globalObject->weakMapStructure()
    67         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->weakMapStructure());
     65    Structure* weakMapStructure = JSC_GET_DERIVED_STRUCTURE(vm, weakMapStructure, newTarget, callFrame->jsCallee());
    6866    RETURN_IF_EXCEPTION(scope, { });
    6967

  • trunk/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.cpp

    r267594 r273661  
    6565
    6666    JSObject* newTarget = asObject(callFrame->newTarget());
    67     Structure* weakObjectRefStructure = newTarget == callFrame->jsCallee()
    68         ? globalObject->weakObjectRefStructure()
    69         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->weakObjectRefStructure());
     67    Structure* weakObjectRefStructure = JSC_GET_DERIVED_STRUCTURE(vm, weakObjectRefStructure, newTarget, callFrame->jsCallee());
    7068    RETURN_IF_EXCEPTION(scope, { });
    7169

  • trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp

    r267594 r273661  
    6363
    6464    JSObject* newTarget = asObject(callFrame->newTarget());
    65     Structure* weakSetStructure = newTarget == callFrame->jsCallee()
    66         ? globalObject->weakSetStructure()
    67         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->weakSetStructure());
     65    Structure* weakSetStructure = JSC_GET_DERIVED_STRUCTURE(vm, weakSetStructure, newTarget, callFrame->jsCallee());
    6866    RETURN_IF_EXCEPTION(scope, { });
    6967

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.cpp

    r273203 r273661  
    5454
    5555    JSObject* newTarget = asObject(callFrame->newTarget());
    56     Structure* structure = newTarget == callFrame->jsCallee()
    57         ? globalObject->webAssemblyCompileErrorStructure()
    58         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyCompileErrorStructure());
     56    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyCompileErrorStructure, newTarget, callFrame->jsCallee());
    5957    RETURN_IF_EXCEPTION(scope, { });
    6058

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyGlobalConstructor.cpp

    r272194 r273661  
    5656
    5757    JSObject* newTarget = asObject(callFrame->newTarget());
    58     Structure* webAssemblyGlobalStructure = newTarget == callFrame->jsCallee()
    59         ? globalObject->webAssemblyGlobalStructure()
    60         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyGlobalStructure());
     58    Structure* webAssemblyGlobalStructure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyGlobalStructure, newTarget, callFrame->jsCallee());
    6159    RETURN_IF_EXCEPTION(throwScope, { });
    6260

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp

    r267594 r273661  
    6767
    6868    JSObject* newTarget = asObject(callFrame->newTarget());
    69     Structure* instanceStructure = newTarget == callFrame->jsCallee()
    70         ? globalObject->webAssemblyInstanceStructure()
    71         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyInstanceStructure());
     69    Structure* instanceStructure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyInstanceStructure, newTarget, callFrame->jsCallee());
    7270    RETURN_IF_EXCEPTION(scope, { });
    7371

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.cpp

    r273203 r273661  
    5454
    5555    JSObject* newTarget = asObject(callFrame->newTarget());
    56     Structure* structure = newTarget == callFrame->jsCallee()
    57         ? globalObject->webAssemblyLinkErrorStructure()
    58         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyLinkErrorStructure());
     56    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyLinkErrorStructure, newTarget, callFrame->jsCallee());
    5957    RETURN_IF_EXCEPTION(scope, { });
    6058

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp

    r271774 r273661  
    5959
    6060    JSObject* newTarget = asObject(callFrame->newTarget());
    61     Structure* webAssemblyMemoryStructure = newTarget == callFrame->jsCallee()
    62         ? globalObject->webAssemblyMemoryStructure()
    63         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyMemoryStructure());
     61    Structure* webAssemblyMemoryStructure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyMemoryStructure, newTarget, callFrame->jsCallee());
    6462    RETURN_IF_EXCEPTION(throwScope, { });
    6563

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp

    r267594 r273661  
    181181
    182182    JSObject* newTarget = asObject(callFrame->newTarget());
    183     Structure* structure = newTarget == callFrame->jsCallee()
    184         ? globalObject->webAssemblyModuleStructure()
    185         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyModuleStructure());
     183    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyModuleStructure, newTarget, callFrame->jsCallee());
    186184    RETURN_IF_EXCEPTION(scope, nullptr);
    187185

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp

    r273203 r273661  
    5656
    5757    JSObject* newTarget = asObject(callFrame->newTarget());
    58     Structure* structure = newTarget == callFrame->jsCallee()
    59         ? globalObject->webAssemblyRuntimeErrorStructure()
    60         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyRuntimeErrorStructure());
     58    Structure* structure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyRuntimeErrorStructure, newTarget, callFrame->jsCallee());
    6159    RETURN_IF_EXCEPTION(scope, { });
    6260

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.cpp

    r272081 r273661  
    5757
    5858    JSObject* newTarget = asObject(callFrame->newTarget());
    59     Structure* webAssemblyTableStructure = newTarget == callFrame->jsCallee()
    60         ? globalObject->webAssemblyTableStructure()
    61         : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyTableStructure());
     59    Structure* webAssemblyTableStructure = JSC_GET_DERIVED_STRUCTURE(vm, webAssemblyTableStructure, newTarget, callFrame->jsCallee());
    6260    RETURN_IF_EXCEPTION(throwScope, { });
    6361

  • trunk/Source/WebCore/ChangeLog

    r273657 r273661  
     12021-03-01  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Throw TypeError when getFunctionRealm hits revoked Proxy
     4        https://bugs.webkit.org/show_bug.cgi?id=222523
     5
     6        Reviewed by Alexey Shvayka.
     7
     8        * bindings/js/JSDOMWrapperCache.h:
     9        (WebCore::setSubclassStructureIfNeeded):
     10        * bindings/js/JSHTMLElementCustom.cpp:
     11        (WebCore::constructJSHTMLElement):
     12
    1132021-02-25  Simon Fraser  <simon.fraser@apple.com>
    214

  • trunk/Source/WebCore/bindings/js/JSDOMWrapperCache.h

    r268271 r273661  
    217217    auto scope = DECLARE_THROW_SCOPE(vm);
    218218
    219     auto* newTargetGlobalObject = JSC::jsCast<JSDOMGlobalObject*>(JSC::getFunctionRealm(vm, newTarget));
     219    auto* functionGlobalObject = JSC::getFunctionRealm(lexicalGlobalObject, newTarget);
     220    RETURN_IF_EXCEPTION(scope, void());
     221    auto* newTargetGlobalObject = JSC::jsCast<JSDOMGlobalObject*>(functionGlobalObject);
    220222    auto* baseStructure = getDOMStructure<WrapperClass>(vm, *newTargetGlobalObject);
    221223    auto* subclassStructure = JSC::InternalFunction::createSubclassStructure(lexicalGlobalObject, newTarget, baseStructure);

  • trunk/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp

    r260732 r273661  
    5656
    5757    auto* newTarget = callFrame.newTarget().getObject();
    58     auto* newTargetGlobalObject = jsCast<JSDOMGlobalObject*>(getFunctionRealm(vm, newTarget));
     58    auto* functionGlobalObject = getFunctionRealm(lexicalGlobalObject, newTarget);
     59    RETURN_IF_EXCEPTION(scope, { });
     60    auto* newTargetGlobalObject = jsCast<JSDOMGlobalObject*>(functionGlobalObject);
    5961    JSValue htmlElementConstructorValue = JSHTMLElement::getConstructor(vm, newTargetGlobalObject);
    6062    if (newTarget == htmlElementConstructorValue)
Note: See TracChangeset for help on using the changeset viewer.