Changeset 148142 in webkit

Timestamp:

Apr 10, 2013 3:25:36 PM (11 years ago)

Author:

mhahnenberg@apple.com

Message:

JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
​https://bugs.webkit.org/show_bug.cgi?id=114235

Reviewed by Filip Pizlo.

If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are
accessible in the base object's backing store, which is bad.

Source/JavaScriptCore:

• runtime/JSObject.cpp:

(JSC::JSObject::getPropertyNames):
(JSC::JSObject::getOwnNonIndexPropertyNames):

• runtime/PropertyNameArray.h:

(JSC::PropertyNameArray::PropertyNameArray):
(JSC::PropertyNameArray::setNumCacheableSlotsForObject):
(JSC::PropertyNameArray::setBaseObject):
(PropertyNameArray):

LayoutTests:

• fast/js/get-by-pname-only-prototype-properties-expected.txt: Added.
• fast/js/get-by-pname-only-prototype-properties.html: Added.
• fast/js/script-tests/get-by-pname-only-prototype-properties.js: Added.

(foo):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/get-by-pname-only-prototype-properties-expected.txt (added)
• LayoutTests/fast/js/get-by-pname-only-prototype-properties.html (added)
• LayoutTests/fast/js/script-tests/get-by-pname-only-prototype-properties.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (2 diffs)
• Source/JavaScriptCore/runtime/PropertyNameArray.h (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-04-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=114235
+
+        Reviewed by Filip Pizlo.
+
+        If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are 
+        accessible in the base object's backing store, which is bad.
+
+        * fast/js/get-by-pname-only-prototype-properties-expected.txt: Added.
+        * fast/js/get-by-pname-only-prototype-properties.html: Added.
+        * fast/js/script-tests/get-by-pname-only-prototype-properties.js: Added.
+        (foo):
+
 2013-04-10  Hans Muller  <hmuller@adobe.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-04-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=114235
+
+        Reviewed by Filip Pizlo.
+
+        If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are 
+        accessible in the base object's backing store, which is bad.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setNumCacheableSlotsForObject):
+        (JSC::PropertyNameArray::setBaseObject):
+        (PropertyNameArray):
+
 2013-04-10  Patrick Gansterer  <paroga@webkit.org>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -1443 +1443 @@
 void JSObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    propertyNames.setBaseObject(object);
     object->methodTable()->getOwnPropertyNames(object, exec, propertyNames, mode);
 
@@ -1538 +1539 @@
 
     if (canCachePropertiesFromStructure)
-        propertyNames.setNumCacheableSlots(propertyNames.size());
+        propertyNames.setNumCacheableSlotsForObject(object, propertyNames.size());
 }
 

trunk/Source/JavaScriptCore/runtime/PropertyNameArray.h

@@ -57 +57 @@
             , m_globalData(globalData)
             , m_numCacheableSlots(0)
+            , m_baseObject(0)
         {
         }
@@ -64 +65 @@
             , m_globalData(&exec->globalData())
             , m_numCacheableSlots(0)
+            , m_baseObject(0)
         {
         }
@@ -87 +89 @@
 
         size_t numCacheableSlots() const { return m_numCacheableSlots; }
-        void setNumCacheableSlots(size_t numCacheableSlots) { m_numCacheableSlots = numCacheableSlots; }
+        void setNumCacheableSlotsForObject(JSObject* object, size_t numCacheableSlots)
+        {
+            if (object != m_baseObject)
+                return;
+            m_numCacheableSlots = numCacheableSlots;
+        }
+        void setBaseObject(JSObject* object)
+        {
+            if (m_baseObject)
+                return;
+            m_baseObject = object;
+        }
 
     private:
@@ -96 +109 @@
         JSGlobalData* m_globalData;
         size_t m_numCacheableSlots;
+        JSObject* m_baseObject;
     };