Changeset 246808 in webkit

Timestamp:

Jun 25, 2019 2:19:21 PM (5 years ago)

Author:

keith_miller@apple.com

Message:

Add didBecomePrototype() calls to global context prototypes
​https://bugs.webkit.org/show_bug.cgi?id=199202

Reviewed by Mark Lam.

This fixes some crashes related to asserting that all prototypes
have been marked as such in JSC from
​https://trac.webkit.org/changeset/246801. It's ok to call
didBecomePrototype here as we setting up the world state right now
so we won't be having a bad time.

We don't automatically call didBecomePrototype() for
setPrototypeWithoutTransition because existing objects may already
have this structure so it seems more reasonable to be explicit
there.

• bindings/js/JSWindowProxy.cpp:

(WebCore::JSWindowProxy::setWindow):

• bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::initScript):

• worklets/WorkletScriptController.cpp:

(WebCore::WorkletScriptController::initScriptWithSubclass):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSWindowProxy.cpp (modified) (1 diff)
• bindings/js/WorkerScriptController.cpp (modified) (2 diffs)
• worklets/WorkletScriptController.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-06-25  Keith Miller  <keith_miller@apple.com>
+
+        Add didBecomePrototype() calls to global context prototypes
+        https://bugs.webkit.org/show_bug.cgi?id=199202
+
+        Reviewed by Mark Lam.
+
+        This fixes some crashes related to asserting that all prototypes
+        have been marked as such in JSC from
+        https://trac.webkit.org/changeset/246801. It's ok to call
+        didBecomePrototype here as we setting up the world state right now
+        so we won't be having a bad time.
+
+        We don't automatically call didBecomePrototype() for
+        setPrototypeWithoutTransition because existing objects may already
+        have this structure so it seems more reasonable to be explicit
+        there.
+
+        * bindings/js/JSWindowProxy.cpp:
+        (WebCore::JSWindowProxy::setWindow):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * worklets/WorkletScriptController.cpp:
+        (WebCore::WorkletScriptController::initScriptWithSubclass):
+
 2019-06-25  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/WebCore/bindings/js/JSWindowProxy.cpp

@@ -112 +112 @@
     auto& propertiesStructure = *JSDOMWindowProperties::createStructure(vm, window, JSEventTarget::prototype(vm, *window));
     auto& properties = *JSDOMWindowProperties::create(&propertiesStructure, *window);
+    properties.didBecomePrototype();
     prototype->structure(vm)->setPrototypeWithoutTransition(vm, &properties);
 

trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp

@@ -91 +91 @@
         ASSERT(m_workerGlobalScopeWrapper->structure(*m_vm)->globalObject() == m_workerGlobalScopeWrapper);
         dedicatedContextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
-        dedicatedContextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get()));
+        auto* workerGlobalScopePrototype = JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get());
+        workerGlobalScopePrototype->didBecomePrototype();
+        dedicatedContextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, workerGlobalScopePrototype);
 
         proxy->setTarget(*m_vm, m_workerGlobalScopeWrapper.get());
@@ -108 +110 @@
         ASSERT(m_workerGlobalScopeWrapper->structure()->globalObject() == m_workerGlobalScopeWrapper);
         contextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
-        contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get()));
+        auto* workerGlobalScopePrototype = JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get());
+        workerGlobalScopePrototype->didBecomePrototype();
+        contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, workerGlobalScopePrototype);
 
         proxy->setTarget(*m_vm, m_workerGlobalScopeWrapper.get());

trunk/Source/WebCore/worklets/WorkletScriptController.cpp

@@ -127 +127 @@
     ASSERT(m_workletGlobalScopeWrapper->structure(*m_vm)->globalObject() == m_workletGlobalScopeWrapper);
     contextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workletGlobalScopeWrapper.get());
-    contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSGlobalScope::prototype(*m_vm, *m_workletGlobalScopeWrapper.get()));
+    auto* globalScopePrototype = JSGlobalScope::prototype(*m_vm, *m_workletGlobalScopeWrapper.get());
+    globalScopePrototype->didBecomePrototype();
+    contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, globalScopePrototype);
 
     proxy->setTarget(*m_vm, m_workletGlobalScopeWrapper.get());