Changeset 264809 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Jul 23, 2020, 8:53:46 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] Arrow function |this| resolution should not be trapped by with-scope
​https://bugs.webkit.org/show_bug.cgi?id=214716
<rdar://problem/65980639>

Reviewed by Darin Adler.

JSTests:

• stress/proxy-trap-this.js: Added.

(shouldNotThrow):
(const.handler.has):
(test):

Source/JavaScriptCore:

We were using usual "this" named variable in lexical-environment to load and store arrow-function's |this|.
But since this looks normal variable, it can be trapped by "with" scope's object while it should not be.
We use thisPrivateName instead to avoid this behavior since Proxy does not trap private names.

• builtins/BuiltinNames.h:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
(JSC::BytecodeGenerator::variable):
(JSC::BytecodeGenerator::createVariable):
(JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
(JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):

• bytecompiler/NodesCodegen.cpp:

(JSC::HasOwnPropertyFunctionCallDotNode::emitBytecode):
(JSC::ForInNode::emitBytecode):

• runtime/CommonIdentifiers.cpp:

(JSC::CommonIdentifiers::CommonIdentifiers):

• runtime/CommonIdentifiers.h:

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -1956 +1956 @@
             // After generator.ensureThis (which must be invoked in |base|'s materialization), we can ensure that |this| is in local this-register.
             ASSERT(base);
-            return generator.variable(generator.propertyNames().thisIdentifier, ThisResolutionType::Local) == structureContext->baseVariable().value();
+            return generator.variable(generator.propertyNames().builtinNames().thisPrivateName(), ThisResolutionType::Local) == structureContext->baseVariable().value();
         }
         return false;
@@ -3895 +3895 @@
         // After generator.ensureThis (which must be invoked in |base|'s materialization), we can ensure that |this| is in local this-register.
         ASSERT(base);
-        baseVariable = generator.variable(generator.propertyNames().thisIdentifier, ThisResolutionType::Local);
+        baseVariable = generator.variable(generator.propertyNames().builtinNames().thisPrivateName(), ThisResolutionType::Local);
     }