Ignore:
Timestamp:
Dec 12, 2019, 1:33:55 PM (5 years ago)
Author:
[email protected]
Message:

[JSC] Lock-down JSGlobalObject and derived classes in IsoSubspace
​https://bugs.webkit.org/show_bug.cgi?id=205108

Reviewed by Mark Lam.

Source/JavaScriptCore:

This patch puts JSGlobalLexicalEnvironment and JSGlobalObject (and its derived classes including JSDOMWindow etc.) in IsoSubspace.
We were using addFinalizer feature to call destructors for these objects since they do not inherit JSDestructibleObject. But now
each derived classes has its IsoSubspace. So we do not need to use finalizer feature: just setting specialized HeapCellType works.

  • API/JSAPIGlobalObject.h:
  • API/JSCallbackObject.cpp:
  • API/glib/JSAPIWrapperGlobalObject.cpp:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/SuperSampler.h:
  • heap/CellAttributes.h:
  • heap/FreeList.h:
  • heap/IsoHeapCellType.cpp:

(JSC::IsoHeapCellType::IsoHeapCellType):

  • heap/IsoHeapCellType.h:
  • heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::setIsFreeListed): Deleted.

  • heap/MarkedBlockInlines.h:

(JSC::MarkedBlock::Handle::setIsFreeListed):

  • jsc.cpp:

(GlobalObject::create): Deleted.
(GlobalObject::createStructure): Deleted.
(GlobalObject::javaScriptRuntimeFlags): Deleted.
(GlobalObject::finishCreation): Deleted.
(GlobalObject::addFunction): Deleted.

  • runtime/JSGlobalLexicalEnvironment.h:
  • runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::subspaceFor):

  • runtime/JSSegmentedVariableObject.cpp:

(JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
(JSC::JSSegmentedVariableObject::finishCreation):
(JSC::JSSegmentedVariableObject::destroy): Deleted.

  • runtime/JSSegmentedVariableObject.h:

(JSC::JSSegmentedVariableObject::subspaceFor):
(JSC::JSSegmentedVariableObject::classInfo const): Deleted.

  • runtime/VM.cpp:

(JSC::VM::VM):

  • runtime/VM.h:
  • testRegExp.cpp:

(GlobalObject::create): Deleted.
(GlobalObject::createStructure): Deleted.
(GlobalObject::finishCreation): Deleted.

Source/WebCore:

We put derived classes of JSGlobalObject in IsoSubspace in WebCore side too.

  • bindings/js/JSDOMGlobalObject.h:
  • bindings/js/JSDOMWindowBase.h:
  • bindings/js/JSDOMWrapper.cpp:

(WebCore::globalObjectOutputConstraintSubspaceFor): Deleted.

  • bindings/js/JSDOMWrapper.h:
  • bindings/js/JSRemoteDOMWindowBase.h:
  • bindings/js/JSWindowProxy.h:
  • bindings/js/JSWorkerGlobalScopeBase.h:

(WebCore::JSWorkerGlobalScopeBase::subspaceFor):

  • bindings/js/JSWorkletGlobalScopeBase.h:

(WebCore::JSWorkletGlobalScopeBase::subspaceFor):

  • bindings/js/WebCoreJSClientData.cpp:

(WebCore::JSVMClientData::JSVMClientData):

  • bindings/js/WebCoreJSClientData.h:

(WebCore::JSVMClientData::subspaceForJSDOMWindow):
(WebCore::JSVMClientData::subspaceForJSDedicatedWorkerGlobalScope):
(WebCore::JSVMClientData::subspaceForJSRemoteDOMWindow):
(WebCore::JSVMClientData::subspaceForJSWorkerGlobalScope):
(WebCore::JSVMClientData::subspaceForJSServiceWorkerGlobalScope):
(WebCore::JSVMClientData::subspaceForJSPaintWorkletGlobalScope):
(WebCore::JSVMClientData::subspaceForJSWorkletGlobalScope):
(WebCore::JSVMClientData::forEachOutputConstraintSpace):
(WebCore::JSVMClientData::globalObjectOutputConstraintSpace): Deleted.

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):
(GeneratePrototypeDeclaration):

  • bindings/scripts/test/JS/JSInterfaceName.cpp:
  • bindings/scripts/test/JS/JSMapLike.cpp:
  • bindings/scripts/test/JS/JSReadOnlyMapLike.cpp:
  • bindings/scripts/test/JS/JSReadOnlySetLike.cpp:
  • bindings/scripts/test/JS/JSSetLike.cpp:
  • bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
  • bindings/scripts/test/JS/JSTestCEReactions.cpp:
  • bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
  • bindings/scripts/test/JS/JSTestCallTracer.cpp:
  • bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
  • bindings/scripts/test/JS/JSTestDOMJIT.cpp:
  • bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:
  • bindings/scripts/test/JS/JSTestEnabledForContext.cpp:
  • bindings/scripts/test/JS/JSTestEventConstructor.cpp:
  • bindings/scripts/test/JS/JSTestEventTarget.cpp:
  • bindings/scripts/test/JS/JSTestException.cpp:
  • bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
  • bindings/scripts/test/JS/JSTestGlobalObject.cpp:

(WebCore::JSTestGlobalObject::subspaceForImpl):

  • bindings/scripts/test/JS/JSTestGlobalObject.h:

(WebCore::JSTestGlobalObject::subspaceFor):

  • bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:
  • bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestInterface.cpp:
  • bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:
  • bindings/scripts/test/JS/JSTestIterable.cpp:
  • bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
  • bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
  • bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
  • bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
  • bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:
  • bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:
  • bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:
  • bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp:
  • bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp:
  • bindings/scripts/test/JS/JSTestNode.cpp:
  • bindings/scripts/test/JS/JSTestObj.cpp:
  • bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
  • bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
  • bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
  • bindings/scripts/test/JS/JSTestPluginInterface.cpp:
  • bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:
  • bindings/scripts/test/JS/JSTestSerialization.cpp:
  • bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.cpp:
  • bindings/scripts/test/JS/JSTestSerializationInherit.cpp:
  • bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp:
  • bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
  • bindings/scripts/test/JS/JSTestStringifier.cpp:
  • bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp:
  • bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp:
  • bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp:
  • bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp:
  • bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp:
  • bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp:
  • bindings/scripts/test/JS/JSTestTypedefs.cpp:
  • bridge/runtime_method.h:
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/testRegExp.cpp

    r250005 r253443  
    103103};
    104104
    105 class GlobalObject : public JSGlobalObject {
     105class GlobalObject final : public JSGlobalObject {
    106106private:
    107107    GlobalObject(VM&, Structure*, const Vector<String>& arguments);
    108108
    109109public:
    110     typedef JSGlobalObject Base;
     110    using Base = JSGlobalObject;
    111111
    112112    static GlobalObject* create(VM& vm, Structure* structure, const Vector<String>& arguments)
    … …  
    118118    DECLARE_INFO;
    119119
    120     static constexpr bool needsDestructor = false;
     120    static constexpr bool needsDestructor = true;
    121121
    122122    static Structure* createStructure(VM& vm, JSValue prototype)
    … …  
    132132    }
    133133};
     134STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(GlobalObject, JSGlobalObject);
    134135
    135136const ClassInfo GlobalObject::s_info = { "global", &JSGlobalObject::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(GlobalObject) };
Note: See TracChangeset for help on using the changeset viewer.