Changeset 217887 in webkit for trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

Timestamp:

Jun 7, 2017, 9:54:05 AM (8 years ago)

Author:

Yusuke Suzuki

Message:

[JSC] has_generic_property never accepts non-String
​https://bugs.webkit.org/show_bug.cgi?id=173057

Reviewed by Darin Adler.

We never pass non-String value to has_generic_property bytecode.

• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

File:

• trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -705 +705 @@
     if (base->structure(vm)->id() == enumerator->cachedStructureID())
         RETURN(jsBoolean(true));
-    RETURN(jsBoolean(base->hasPropertyGeneric(exec, asString(property.asCell())->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
+    JSString* string = asString(property);
+    auto propertyName = string->toIdentifier(exec);
+    CHECK_EXCEPTION();
+    RETURN(jsBoolean(base->hasPropertyGeneric(exec, propertyName, PropertySlot::InternalMethodType::GetOwnProperty)));
 }
 
@@ -714 +717 @@
     CHECK_EXCEPTION();
     JSValue property = OP(3).jsValue();
-    bool result;
-    if (property.isString())
-        result = base->hasPropertyGeneric(exec, asString(property.asCell())->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty);
-    else {
-        ASSERT(property.isUInt32());
-        result = base->hasPropertyGeneric(exec, property.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty);
-    }
-    RETURN(jsBoolean(result));
+    JSString* string = asString(property);
+    auto propertyName = string->toIdentifier(exec);
+    CHECK_EXCEPTION();
+    RETURN(jsBoolean(base->hasPropertyGeneric(exec, propertyName, PropertySlot::InternalMethodType::GetOwnProperty)));
 }
 
@@ -729 +728 @@
     JSValue baseValue = OP_C(2).jsValue();
     JSValue property = OP(3).jsValue();
-    ASSERT(property.isString());
-    RETURN(baseValue.get(exec, asString(property)->toIdentifier(exec)));
+    JSString* string = asString(property);
+    auto propertyName = string->toIdentifier(exec);
+    CHECK_EXCEPTION();
+    RETURN(baseValue.get(exec, propertyName));
 }