Changeset 195462 in webkit for trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp

Timestamp:

Jan 22, 2016, 11:31:06 AM (10 years ago)

Author:

[email protected]

Message:

Equivalence PropertyCondition needs to check the offset it uses to load the value from is not invalidOffset
​https://bugs.webkit.org/show_bug.cgi?id=152912

Reviewed by Mark Lam.

When checking the validity of an Equivalence PropertyCondition we do not check that the offset returned by
the structure of the object in the equivalence condition is valid. The offset might be wrong for many reasons.
The one we now test for is when the GlobalObject has a property that becomes a variable the property is deleted
thus the offset is now invalid.

• bytecode/PropertyCondition.cpp:

(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint):

• tests/stress/global-property-into-variable-get-from-scope.js: Added.

File:

• trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp

@@ -173 +173 @@
         
         PropertyOffset currentOffset = structure->getConcurrently(uid());
+        if (currentOffset == invalidOffset) {
+            if (verbose) {
+                dataLog(
+                    "Invalid because the base no long appears to have ", uid(), " on its structure: ",
+                        RawPointer(base), "\n");
+            }
+            return false;
+        }
+
         JSValue currentValue = base->getDirect(currentOffset);
         if (currentValue != requiredValue()) {