Changeset 128816 in webkit for trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

Timestamp:

Sep 17, 2012, 3:47:37 PM (13 years ago)

Author:

[email protected]

Message:

We don't have a bad enough time if an object's prototype chain crosses global objects
​https://bugs.webkit.org/show_bug.cgi?id=96962

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

• runtime/JSGlobalObject.cpp:

(JSC):

LayoutTests:

• fast/js/cross-frame-really-bad-time-expected.txt: Added.
• fast/js/cross-frame-really-bad-time-with-proto-expected.txt: Added.
• fast/js/cross-frame-really-bad-time-with-proto.html: Added.
• fast/js/cross-frame-really-bad-time.html: Added.
• fast/js/script-tests/cross-frame-really-bad-time-with-proto.js: Added.

(foo):
(evil):
(bar):
(done):

• fast/js/script-tests/cross-frame-really-bad-time.js: Added.

(Cons):
(foo):
(evil):
(bar):
(done):

File:

• trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

@@ -364 +364 @@
     
     JSObject* object = asObject(cell);
+
+    // Run this filter first, since it's cheap, and ought to filter out a lot of objects.
+    if (!hasBrokenIndexing(object))
+        return;
     
     // We only want to have a bad time in the affected global object, not in the entire
-    // VM.
-    if (object->unwrappedGlobalObject() != m_globalObject)
-        return;
-    
-    if (!hasBrokenIndexing(object))
+    // VM. But we have to be careful, since there may be objects that claim to belong to
+    // a different global object that has prototypes from our global object.
+    bool foundGlobalObject = false;
+    for (JSObject* current = object; ;) {
+        if (current->unwrappedGlobalObject() == m_globalObject) {
+            foundGlobalObject = true;
+            break;
+        }
+        
+        JSValue prototypeValue = current->prototype();
+        if (prototypeValue.isNull())
+            break;
+        current = asObject(prototypeValue);
+    }
+    if (!foundGlobalObject)
         return;