Changeset 232211 in webkit for trunk/Source/JavaScriptCore/runtime/Lookup.cpp

Timestamp:

May 25, 2018, 4:18:15 PM (7 years ago)

Author:

[email protected]

Message:

Enforce invariant that GetterSetter objects are invariant.
​https://bugs.webkit.org/show_bug.cgi?id=185968
<rdar://problem/40541416>

Reviewed by Saam Barati.

The code already assumes the invariant that GetterSetter objects are immutable.
For example, the use of @tryGetById in builtins expect this invariant to be true.
The existing code mostly enforces this except for one case: JSObject's
validateAndApplyPropertyDescriptor, where it will re-use the same GetterSetter
object.

This patch enforces this invariant by removing the setGetter and setSetter methods
of GetterSetter, and requiring the getter/setter callback functions to be
specified at construction time.

• jit/JITOperations.cpp:
• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• runtime/GetterSetter.cpp:

(JSC::GetterSetter::withGetter): Deleted.
(JSC::GetterSetter::withSetter): Deleted.

• runtime/GetterSetter.h:
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

• runtime/JSObject.cpp:

(JSC::JSObject::putIndexedDescriptor):
(JSC::JSObject::putDirectNativeIntrinsicGetter):
(JSC::putDescriptor):
(JSC::validateAndApplyPropertyDescriptor):

• runtime/JSTypedArrayViewPrototype.cpp:

(JSC::JSTypedArrayViewPrototype::finishCreation):

• runtime/Lookup.cpp:

(JSC::reifyStaticAccessor):

• runtime/PropertyDescriptor.cpp:

(JSC::PropertyDescriptor::slowGetterSetter):

File:

• trunk/Source/JavaScriptCore/runtime/Lookup.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/Lookup.cpp

@@ -30 +30 @@
 {
     JSGlobalObject* globalObject = thisObject.globalObject();
-    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
+    JSObject* getter = nullptr;
     if (value.accessorGetter()) {
-        JSFunction* function = nullptr;
         if (value.attributes() & PropertyAttribute::Builtin)
-            function = JSFunction::create(vm, value.builtinAccessorGetterGenerator()(vm), globalObject);
+            getter = JSFunction::create(vm, value.builtinAccessorGetterGenerator()(vm), globalObject);
         else {
             String getterName = tryMakeString(ASCIILiteral("get "), String(*propertyName.publicName()));
             if (!getterName)
                 return;
-            function = JSFunction::create(vm, globalObject, 0, getterName, value.accessorGetter());
+            getter = JSFunction::create(vm, globalObject, 0, getterName, value.accessorGetter());
         }
-        accessor->setGetter(vm, globalObject, function);
     }
+    GetterSetter* accessor = GetterSetter::create(vm, globalObject, getter, nullptr);
     thisObject.putDirectNonIndexAccessor(vm, propertyName, accessor, attributesForStructure(value.attributes()));
 }