Changeset 196179 in webkit for trunk/Source/JavaScriptCore/runtime/Structure.h

Timestamp:

Feb 5, 2016, 11:52:19 AM (9 years ago)

Author:

[email protected]

Message:

Arrayify for a typed array shouldn't create a monster
​https://bugs.webkit.org/show_bug.cgi?id=153908
rdar://problem/24290639

Reviewed by Mark Lam.

Previously if you convinced the DFG to emit an Arrayify to ArrayStorage and then gave it a
typed array, you'd corrupt the object.

• runtime/JSArrayBufferView.cpp:

(WTF::printInternal):

• runtime/JSArrayBufferView.h:
• runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):

• runtime/JSObject.cpp:

(JSC::JSObject::copyButterfly):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::ensureInt32Slow):
(JSC::JSObject::ensureDoubleSlow):
(JSC::JSObject::ensureContiguousSlow):
(JSC::JSObject::ensureArrayStorageSlow):
(JSC::JSObject::growOutOfLineStorage):
(JSC::getBoundSlotBaseFunctionForGetterSetter):

• runtime/Structure.h:
• tests/stress/arrayify-array-storage-typed-array.js: Added. This test failed.
• tests/stress/arrayify-int32-typed-array.js: Added. This test case already had other protections, but we beefed them up.

File:

• trunk/Source/JavaScriptCore/runtime/Structure.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/runtime/Structure.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2008, 2009, 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2012-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -321 +321 @@
             && (offset < m_inlineCapacity || offset >= firstOutOfLineOffset);
     }
+
+    bool hijacksIndexingHeader() const
+    {
+        return isTypedView(m_classInfo->typedArrayStorageType);
+    }
     
     bool couldHaveIndexingHeader() const
     {
         return hasIndexedProperties(indexingType())
-            || isTypedView(m_classInfo->typedArrayStorageType);
+            || hijacksIndexingHeader();
     }