Changeset 249538 in webkit for trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp

Timestamp:

Sep 5, 2019, 11:47:55 AM (6 years ago)

Author:

Tadeu Zagallo

Message:

LazyClassStructure::setConstructor should not store the constructor to the global object
​https://bugs.webkit.org/show_bug.cgi?id=201484
<rdar://problem/50400451>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/web-assembly-constructors-should-not-override-global-object-property.js: Added.

Source/JavaScriptCore:

LazyClassStructure::setConstructor sets the constructor as a property of the global object.
This became a problem when it started being used for WebAssembly constructors, such as Module
and Instance, since they are properties of the WebAssembly object, not the global object. That
resulted in properties of the global object replaced whenever a lazy WebAssembly constructor
was first accessed. e.g.

globalThis.Module = x;
WebAssembly.Module;
globalThis.Module === WebAssembly.Module;

• runtime/LazyClassStructure.cpp:

(JSC::LazyClassStructure::Initializer::setConstructor):

• runtime/LazyClassStructure.h:
• runtime/Lookup.h:

(JSC::reifyStaticProperty):

File:

• trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp

@@ -61 +61 @@
 }
 
-void LazyClassStructure::Initializer::setConstructor(PropertyName propertyName, JSObject* constructor)
+void LazyClassStructure::Initializer::setConstructor(JSObject* constructor)
 {
     RELEASE_ASSERT(structure);
@@ -70 +70 @@
 
     prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, constructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
-    if (!propertyName.isNull())
-        global->putDirect(vm, propertyName, constructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
     classStructure.m_constructor.set(vm, global, constructor);
-}
-
-void LazyClassStructure::Initializer::setConstructor(JSObject* constructor)
-{
-    String name;
-    if (InternalFunction* internalFunction = jsDynamicCast<InternalFunction*>(vm, constructor))
-        name = internalFunction->name();
-    else if (JSFunction* function = jsDynamicCast<JSFunction*>(vm, constructor))
-        name = function->name(vm);
-    else
-        RELEASE_ASSERT_NOT_REACHED();
-    
-    setConstructor(Identifier::fromString(vm, name), constructor);
 }