Changeset 48331 in webkit for trunk/JavaScriptCore


Ignore:
Timestamp:
Sep 11, 2009, 9:52:39 PM (16 years ago)
Author:
[email protected]
Message:

getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
​https://bugs.webkit.org/show_bug.cgi?id=29214

Reviewed by Sam Weinig.

Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
This flag is used to make sure that caching of the property name data is safe.

Location:
trunk/JavaScriptCore
Files:
17 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/API/JSCallbackConstructor.h

    r47267 r48331  
    4242    static PassRefPtr<Structure> createStructure(JSValue proto)
    4343    {
    44         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark));
     44        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
    4545    }
    4646

  • trunk/JavaScriptCore/ChangeLog

    r48315 r48331  
     12009-09-11  Oliver Hunt  <[email protected]>
     2
     3        Reviewed by Sam Weinig.
     4
     5        getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
     6        https://bugs.webkit.org/show_bug.cgi?id=29214
     7
     8        Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
     9        This flag is used to make sure that caching of the property name data is safe.
     10
     11        * API/JSCallbackConstructor.h:
     12        (JSC::JSCallbackConstructor::createStructure):
     13        * debugger/DebuggerActivation.h:
     14        (JSC::DebuggerActivation::createStructure):
     15        * runtime/BooleanObject.h:
     16        (JSC::BooleanObject::createStructure):
     17        * runtime/DatePrototype.h:
     18        (JSC::DatePrototype::createStructure):
     19        * runtime/FunctionPrototype.h:
     20        (JSC::FunctionPrototype::createStructure):
     21        * runtime/JSONObject.h:
     22        (JSC::JSONObject::createStructure):
     23        * runtime/JSObject.h:
     24        (JSC::JSObject::createStructure):
     25        * runtime/JSTypeInfo.h:
     26        (JSC::TypeInfo::hasDefaultGetPropertyNames):
     27        * runtime/JSVariableObject.h:
     28        (JSC::JSVariableObject::createStructure):
     29        * runtime/JSWrapperObject.h:
     30        (JSC::JSWrapperObject::createStructure):
     31        * runtime/MathObject.h:
     32        (JSC::MathObject::createStructure):
     33        * runtime/NumberConstructor.h:
     34        (JSC::NumberConstructor::createStructure):
     35        * runtime/NumberObject.h:
     36        (JSC::NumberObject::createStructure):
     37        * runtime/RegExpConstructor.h:
     38        (JSC::RegExpConstructor::createStructure):
     39        * runtime/RegExpObject.h:
     40        (JSC::RegExpObject::createStructure):
     41        * runtime/StructureChain.cpp:
     42        (JSC::StructureChain::isCacheable):
     43
    1442009-09-11  Alexey Proskuryakov  <[email protected]>
    245

  • trunk/JavaScriptCore/debugger/DebuggerActivation.h

    r47022 r48331  
    5252        static PassRefPtr<Structure> createStructure(JSValue prototype)
    5353        {
    54             return Structure::create(prototype, TypeInfo(ObjectType));
     54            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
    5555        }
    5656

  • trunk/JavaScriptCore/runtime/BooleanObject.h

    r47267 r48331  
    3535        static PassRefPtr<Structure> createStructure(JSValue prototype)
    3636        {
    37             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
     37            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
    3838        }
    3939    };

  • trunk/JavaScriptCore/runtime/DatePrototype.h

    r47780 r48331  
    4040        static PassRefPtr<Structure> createStructure(JSValue prototype)
    4141        {
    42             return Structure::create(prototype, TypeInfo(ObjectType));
     42            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
    4343        }
    4444    };

  • trunk/JavaScriptCore/runtime/FunctionPrototype.h

    r47267 r48331  
    3535        static PassRefPtr<Structure> createStructure(JSValue proto)
    3636        {
    37             return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
     37            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
    3838        }
    3939

  • trunk/JavaScriptCore/runtime/JSONObject.h

    r47780 r48331  
    4242        static PassRefPtr<Structure> createStructure(JSValue prototype)
    4343        {
    44             return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
     44            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
    4545        }
    4646

  • trunk/JavaScriptCore/runtime/JSObject.h

    r48067 r48331  
    206206        static PassRefPtr<Structure> createStructure(JSValue prototype)
    207207        {
    208             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
     208            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
    209209        }
    210210

  • trunk/JavaScriptCore/runtime/JSTypeInfo.h

    r48207 r48331  
    4343    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
    4444    static const unsigned HasDefaultMark = 1 << 6;
     45    static const unsigned HasDefaultGetPropertyNames = 1 << 7;
    4546
    4647    class TypeInfo {
    … …  
    6566        bool hasStandardGetOwnPropertySlot() const { return m_flags & HasStandardGetOwnPropertySlot; }
    6667        bool hasDefaultMark() const { return m_flags & HasDefaultMark; }
     68        bool hasDefaultGetPropertyNames() const { return m_flags & HasDefaultGetPropertyNames; }
    6769        unsigned flags() const { return m_flags; }
    6870

  • trunk/JavaScriptCore/runtime/JSVariableObject.h

    r47780 r48331  
    5959        Register& registerAt(int index) const { return d->registers[index]; }
    6060
     61        static PassRefPtr<Structure> createStructure(JSValue prototype)
     62        {
     63            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
     64        }
     65       
    6166    protected:
    6267        // Subclasses of JSVariableObject can subclass this struct to add data

  • trunk/JavaScriptCore/runtime/JSWrapperObject.h

    r48067 r48331  
    3939        static PassRefPtr<Structure> createStructure(JSValue prototype)
    4040        {
    41             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
     41            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
    4242        }
    4343

  • trunk/JavaScriptCore/runtime/MathObject.h

    r47780 r48331  
    3838        static PassRefPtr<Structure> createStructure(JSValue prototype)
    3939        {
    40             return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
     40            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
    4141        }
    4242    };

  • trunk/JavaScriptCore/runtime/NumberConstructor.h

    r47780 r48331  
    4040        static PassRefPtr<Structure> createStructure(JSValue proto)
    4141        {
    42             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark));
     42            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
    4343        }
    4444

  • trunk/JavaScriptCore/runtime/NumberObject.h

    r47522 r48331  
    3434        static PassRefPtr<Structure> createStructure(JSValue prototype)
    3535        {
    36             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
     36            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
    3737        }
    3838#else
    3939        static PassRefPtr<Structure> createStructure(JSValue prototype)
    4040        {
    41             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
     41            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
    4242        }
    4343#endif

  • trunk/JavaScriptCore/runtime/RegExpConstructor.h

    r47780 r48331  
    3737        static PassRefPtr<Structure> createStructure(JSValue prototype)
    3838        {
    39             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark));
     39            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
    4040        }
    4141

  • trunk/JavaScriptCore/runtime/RegExpObject.h

    r47780 r48331  
    5050        static PassRefPtr<Structure> createStructure(JSValue prototype)
    5151        {
    52             return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
     52            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
    5353        }
    5454

  • trunk/JavaScriptCore/runtime/StructureChain.cpp

    r45039 r48331  
    5252   
    5353    while (m_vector[i]) {
    54         if (m_vector[i++]->isDictionary())
     54        if (m_vector[i]->isDictionary())
     55            return false;
     56        if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
    5557            return false;
    5658    }
Note: See TracChangeset for help on using the changeset viewer.