Changeset 245203 in webkit

Timestamp:

May 10, 2019 6:40:00 PM (5 years ago)

Author:

sbarati@apple.com

Message:

Call to JSToWasmICCallee::createStructure passes in wrong prototype value
​https://bugs.webkit.org/show_bug.cgi?id=197807
<rdar://problem/50530400>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/js-to-wasm-callee-has-correct-prototype.js: Added.

(test.getInstance):
(test):

Source/JavaScriptCore:

We were passing the empty value instead of null. However, the empty
value means the Structure is poly proto. That's definitely not the case
here.

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/js-to-wasm-callee-has-correct-prototype.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSGlobalObject.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-10  Saam barati  <sbarati@apple.com>
+
+        Call to JSToWasmICCallee::createStructure passes in wrong prototype value
+        https://bugs.webkit.org/show_bug.cgi?id=197807
+        <rdar://problem/50530400>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/js-to-wasm-callee-has-correct-prototype.js: Added.
+        (test.getInstance):
+        (test):
+
 2019-05-10  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-10  Saam barati  <sbarati@apple.com>
+
+        Call to JSToWasmICCallee::createStructure passes in wrong prototype value
+        https://bugs.webkit.org/show_bug.cgi?id=197807
+        <rdar://problem/50530400>
+
+        Reviewed by Yusuke Suzuki.
+
+        We were passing the empty value instead of null. However, the empty
+        value means the Structure is poly proto. That's definitely not the case
+        here.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
 2019-05-10  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

@@ -1063 +1063 @@
         m_jsToWasmICCalleeStructure.initLater(
             [] (const Initializer<Structure>& init) {
-                init.set(JSToWasmICCallee::createStructure(init.vm, init.owner, JSValue()));
+                init.set(JSToWasmICCallee::createStructure(init.vm, init.owner, jsNull()));
             });
         m_webAssemblyWrapperFunctionStructure.initLater(