Skip to content

Commit 0fef586

Browse files
apple-opensourceapple-opensource
committed
7611.3.10.1.3
1 parent 8e18e98 commit 0fef586

File tree

6 files changed

+241
-27
lines changed

6 files changed

+241
-27
lines changed

‎ChangeLog‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,186 @@
1+
2021-06-15 Alan Coon <alancoon@apple.com>
2+
3+
Cherry-pick r278819. rdar://problem/79355258
4+
5+
https://bugs.webkit.org/show_bug.cgi?id=226576
6+
<rdar://problem/78810362>
7+
8+
Reviewed by Yusuke Suzuki.
9+
10+
JSTests:
11+
12+
* stress/short-circuit-read-modify-write-cant-write-dst-before-tdz-check.js: Added.
13+
(let.result.eval.try.captureV):
14+
(catch):
15+
16+
Source/JavaScriptCore:
17+
18+
ShortCircuitReadModifyResolveNode can't emit a value into
19+
its result until after it emits a TDZ check. We were temporarily
20+
storing the result of the get_from_scope into the dst. Then
21+
we'd emit the TDZ check. The TDZ check can throw, and it could
22+
lead to us returning TDZ from the eval itself. Instead, we need
23+
to use a temporary to emit a TDZ check on. Only after the TDZ check
24+
passes can we move the temporary into the result.
25+
26+
* bytecompiler/NodesCodegen.cpp:
27+
(JSC::ShortCircuitReadModifyResolveNode::emitBytecode):
28+
29+
30+
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@278819 268f45cc-cd09-0410-ab3c-d52691b4dbfc
31+
32+
2021-06-13 Saam Barati <sbarati@apple.com>
33+
34+
https://bugs.webkit.org/show_bug.cgi?id=226576
35+
<rdar://problem/78810362>
36+
37+
Reviewed by Yusuke Suzuki.
38+
39+
ShortCircuitReadModifyResolveNode can't emit a value into
40+
its result until after it emits a TDZ check. We were temporarily
41+
storing the result of the get_from_scope into the dst. Then
42+
we'd emit the TDZ check. The TDZ check can throw, and it could
43+
lead to us returning TDZ from the eval itself. Instead, we need
44+
to use a temporary to emit a TDZ check on. Only after the TDZ check
45+
passes can we move the temporary into the result.
46+
47+
* bytecompiler/NodesCodegen.cpp:
48+
(JSC::ShortCircuitReadModifyResolveNode::emitBytecode):
49+
50+
2021-06-15 Alan Coon <alancoon@apple.com>
51+
52+
Cherry-pick r278578. rdar://problem/79355258
53+
54+
Short circuit read modify write nodes emit byte code that uses the wrong locals
55+
https://bugs.webkit.org/show_bug.cgi?id=226576
56+
<rdar://problem/78810362>
57+
58+
Reviewed by Yusuke Suzuki.
59+
60+
JSTests:
61+
62+
* stress/short-circuit-read-modify-should-use-the-write-virtual-registers.js: Added.
63+
(eval):
64+
65+
Source/JavaScriptCore:
66+
67+
It's never a good idea to use the wrong local :-)
68+
69+
This patch also adds support for dumping predecessors of basic blocks
70+
in the bytecode dump.
71+
72+
* bytecode/BytecodeDumper.cpp:
73+
(JSC::CodeBlockBytecodeDumper<Block>::dumpGraph):
74+
* bytecompiler/NodesCodegen.cpp:
75+
(JSC::ShortCircuitReadModifyResolveNode::emitBytecode):
76+
(JSC::ShortCircuitReadModifyDotNode::emitBytecode):
77+
(JSC::ShortCircuitReadModifyBracketNode::emitBytecode):
78+
79+
80+
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@278578 268f45cc-cd09-0410-ab3c-d52691b4dbfc
81+
82+
2021-06-07 Saam Barati <sbarati@apple.com>
83+
84+
Short circuit read modify write nodes emit byte code that uses the wrong locals
85+
https://bugs.webkit.org/show_bug.cgi?id=226576
86+
<rdar://problem/78810362>
87+
88+
Reviewed by Yusuke Suzuki.
89+
90+
It's never a good idea to use the wrong local :-)
91+
92+
This patch also adds support for dumping predecessors of basic blocks
93+
in the bytecode dump.
94+
95+
* bytecode/BytecodeDumper.cpp:
96+
(JSC::CodeBlockBytecodeDumper<Block>::dumpGraph):
97+
* bytecompiler/NodesCodegen.cpp:
98+
(JSC::ShortCircuitReadModifyResolveNode::emitBytecode):
99+
(JSC::ShortCircuitReadModifyDotNode::emitBytecode):
100+
(JSC::ShortCircuitReadModifyBracketNode::emitBytecode):
101+
102+
2021-05-20 Alan Coon <alancoon@apple.com>
103+
104+
Cherry-pick r277613. rdar://problem/78264256
105+
106+
REGRESSION (r271119): Object methods defined with shorthand notation cannot access "caller" in non-strict mode
107+
https://bugs.webkit.org/show_bug.cgi?id=225277
108+
109+
Reviewed by Darin Adler.
110+
111+
JSTests:
112+
113+
* stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Now covers #157461 and #157863.
114+
* stress/function-caller-cross-realm-via-call-apply.js: Added, coverage for #34553.
115+
* stress/function-hidden-as-caller.js: Also adds test case for #102276.
116+
117+
Source/JavaScriptCore:
118+
119+
This patch loosens `function.caller` to allow non-strict getters, setters, arrow functions,
120+
and ES6 methods to be returned as callers, fixing web compatibility.
121+
122+
The intent of r230662 is preserved: generator / async functions are never exposed. There is
123+
no good way to acquire wrapper function from the internal body one, nor from its arguments.
124+
Also, this behavior is on standards track [1] (seems to be considered desirable).
125+
126+
[1]: https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md#get-functionprototypecaller (step 14)
127+
128+
* runtime/JSFunction.cpp:
129+
(JSC::JSC_DEFINE_CUSTOM_GETTER):
130+
131+
132+
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277613 268f45cc-cd09-0410-ab3c-d52691b4dbfc
133+
134+
2021-05-17 Alexey Shvayka <shvaikalesh@gmail.com>
135+
136+
REGRESSION (r271119): Object methods defined with shorthand notation cannot access "caller" in non-strict mode
137+
https://bugs.webkit.org/show_bug.cgi?id=225277
138+
139+
Reviewed by Darin Adler.
140+
141+
This patch loosens `function.caller` to allow non-strict getters, setters, arrow functions,
142+
and ES6 methods to be returned as callers, fixing web compatibility.
143+
144+
The intent of r230662 is preserved: generator / async functions are never exposed. There is
145+
no good way to acquire wrapper function from the internal body one, nor from its arguments.
146+
Also, this behavior is on standards track [1] (seems to be considered desirable).
147+
148+
[1]: https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md#get-functionprototypecaller (step 14)
149+
150+
* runtime/JSFunction.cpp:
151+
(JSC::JSC_DEFINE_CUSTOM_GETTER):
152+
153+
2021-05-20 Alan Coon <alancoon@apple.com>
154+
155+
Cherry-pick r277477. rdar://problem/78264390
156+
157+
[REGRESSION: r271876] Web Inspector: [Cocoa] Remote inspection crashes when using WEB_THREAD
158+
https://bugs.webkit.org/show_bug.cgi?id=225794
159+
160+
Reviewed by Devin Rousso.
161+
162+
For WEB_THREAD, move `callback` in `dispatchAsyncOnTarget` to `block` scope to ensure it is available for the
163+
lifetime of the block.
164+
165+
* inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
166+
(Inspector::RemoteConnectionToTarget::dispatchAsyncOnTarget):
167+
168+
169+
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277477 268f45cc-cd09-0410-ab3c-d52691b4dbfc
170+
171+
2021-05-13 Patrick Angle <pangle@apple.com>
172+
173+
[REGRESSION: r271876] Web Inspector: [Cocoa] Remote inspection crashes when using WEB_THREAD
174+
https://bugs.webkit.org/show_bug.cgi?id=225794
175+
176+
Reviewed by Devin Rousso.
177+
178+
For WEB_THREAD, move `callback` in `dispatchAsyncOnTarget` to `block` scope to ensure it is available for the
179+
lifetime of the block.
180+
181+
* inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm:
182+
(Inspector::RemoteConnectionToTarget::dispatchAsyncOnTarget):
183+
1184
2021-04-27 Russell Epstein <repstein@apple.com>
2185

3186
Cherry-pick r276609. rdar://problem/77211512

‎Configurations/Version.xcconfig‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@
2222
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2323

2424
MAJOR_VERSION = 611;
25-
MINOR_VERSION = 2;
26-
TINY_VERSION = 7;
25+
MINOR_VERSION = 3;
26+
TINY_VERSION = 10;
2727
MICRO_VERSION = 1;
28-
NANO_VERSION = 4;
28+
NANO_VERSION = 3;
2929
FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
3030

3131
// The bundle version and short version string are set based on the current build configuration, see below.

‎bytecode/BytecodeDumper.cpp‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,12 +277,30 @@ void CodeBlockBytecodeDumper<Block>::dumpGraph(Block* block, const InstructionSt
277277

278278
out.printf("\n");
279279

280+
Vector<Vector<unsigned>> predecessors;
281+
predecessors.resize(graph.size());
282+
for (auto& block : graph) {
283+
if (block.isEntryBlock() || block.isExitBlock())
284+
continue;
285+
for (auto successorIndex : block.successors()) {
286+
if (!predecessors[successorIndex].contains(block.index()))
287+
predecessors[successorIndex].append(block.index());
288+
}
289+
}
290+
280291
for (BytecodeBasicBlock& block : graph) {
281292
if (block.isEntryBlock() || block.isExitBlock())
282293
continue;
283294

284295
out.print("bb#", block.index(), "\n");
285296

297+
out.print("Predecessors: [");
298+
for (unsigned predecessor : predecessors[block.index()]) {
299+
if (!graph[predecessor].isEntryBlock())
300+
out.print(" #", predecessor);
301+
}
302+
out.print(" ]\n");
303+
286304
for (unsigned i = 0; i < block.totalLength(); ) {
287305
auto& currentInstruction = instructions.at(i + block.leaderOffset());
288306
dumper.dumpBytecode(currentInstruction, icStatusMap);

‎bytecompiler/NodesCodegen.cpp‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3210,7 +3210,7 @@ RegisterID* ShortCircuitReadModifyResolveNode::emitBytecode(BytecodeGenerator& g
32103210
Ref<Label> afterAssignment = generator.newLabel();
32113211
emitShortCircuitAssignment(generator, result.get(), m_operator, afterAssignment.get());
32123212

3213-
result = generator.emitNode(result.get(), m_right); // Execute side effects first.
3213+
generator.emitNode(result.get(), m_right); // Execute side effects first.
32143214
bool threwException = generator.emitReadOnlyExceptionIfNeeded(var);
32153215

32163216
if (!threwException)
@@ -3227,7 +3227,7 @@ RegisterID* ShortCircuitReadModifyResolveNode::emitBytecode(BytecodeGenerator& g
32273227
Ref<Label> afterAssignment = generator.newLabel();
32283228
emitShortCircuitAssignment(generator, result.get(), m_operator, afterAssignment.get());
32293229

3230-
result = generator.emitNode(result.get(), m_right);
3230+
generator.emitNode(result.get(), m_right);
32313231
generator.move(local.get(), result.get());
32323232
generator.emitProfileType(result.get(), var, divotStart(), divotEnd());
32333233

@@ -3240,7 +3240,7 @@ RegisterID* ShortCircuitReadModifyResolveNode::emitBytecode(BytecodeGenerator& g
32403240
Ref<Label> afterAssignment = generator.newLabel();
32413241
emitShortCircuitAssignment(generator, result.get(), m_operator, afterAssignment.get());
32423242

3243-
result = generator.emitNode(result.get(), m_right);
3243+
generator.emitNode(result.get(), m_right);
32443244
generator.emitProfileType(result.get(), var, divotStart(), divotEnd());
32453245

32463246
generator.emitLabel(afterAssignment.get());
@@ -3250,26 +3250,28 @@ RegisterID* ShortCircuitReadModifyResolveNode::emitBytecode(BytecodeGenerator& g
32503250
generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
32513251
RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
32523252

3253-
RefPtr<RegisterID> result = generator.emitGetFromScope(generator.tempDestination(dst), scope.get(), var, ThrowIfNotFound);
3254-
generator.emitTDZCheckIfNecessary(var, result.get(), nullptr);
3253+
RefPtr<RegisterID> uncheckedResult = generator.newTemporary();
3254+
3255+
generator.emitGetFromScope(uncheckedResult.get(), scope.get(), var, ThrowIfNotFound);
3256+
generator.emitTDZCheckIfNecessary(var, uncheckedResult.get(), nullptr);
32553257

32563258
Ref<Label> afterAssignment = generator.newLabel();
3257-
emitShortCircuitAssignment(generator, result.get(), m_operator, afterAssignment.get());
3259+
emitShortCircuitAssignment(generator, uncheckedResult.get(), m_operator, afterAssignment.get());
32583260

3259-
generator.emitNode(result.get(), m_right); // Execute side effects first.
3261+
generator.emitNode(uncheckedResult.get(), m_right); // Execute side effects first.
32603262

32613263
bool threwException = isReadOnly ? generator.emitReadOnlyExceptionIfNeeded(var) : false;
32623264

32633265
if (!threwException)
32643266
generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
32653267

32663268
if (!isReadOnly) {
3267-
result = generator.emitPutToScope(scope.get(), var, result.get(), ThrowIfNotFound, InitializationMode::NotInitialization);
3268-
generator.emitProfileType(result.get(), var, divotStart(), divotEnd());
3269+
generator.emitPutToScope(scope.get(), var, uncheckedResult.get(), ThrowIfNotFound, InitializationMode::NotInitialization);
3270+
generator.emitProfileType(uncheckedResult.get(), var, divotStart(), divotEnd());
32693271
}
32703272

32713273
generator.emitLabel(afterAssignment.get());
3272-
return generator.move(dst, result.get());
3274+
return generator.move(generator.finalDestination(dst, uncheckedResult.get()), uncheckedResult.get());
32733275
}
32743276

32753277
// ------------------------------ AssignResolveNode -----------------------------------
@@ -3383,24 +3385,24 @@ RegisterID* ShortCircuitReadModifyDotNode::emitBytecode(BytecodeGenerator& gener
33833385
RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
33843386
RefPtr<RegisterID> thisValue;
33853387

3386-
RefPtr<RegisterID> result;
3388+
RefPtr<RegisterID> result = generator.tempDestination(dst);
33873389

33883390
generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
33893391
if (m_base->isSuperNode()) {
33903392
thisValue = generator.ensureThis();
3391-
result = generator.emitGetById(generator.tempDestination(dst), base.get(), thisValue.get(), m_ident);
3393+
generator.emitGetById(result.get(), base.get(), thisValue.get(), m_ident);
33923394
} else
3393-
result = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
3395+
generator.emitGetById(result.get(), base.get(), m_ident);
33943396

33953397
Ref<Label> afterAssignment = generator.newLabel();
33963398
emitShortCircuitAssignment(generator, result.get(), m_operator, afterAssignment.get());
33973399

3398-
result = generator.emitNode(result.get(), m_right);
3400+
generator.emitNode(result.get(), m_right);
33993401
generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
34003402
if (m_base->isSuperNode())
3401-
result = generator.emitPutById(base.get(), thisValue.get(), m_ident, result.get());
3403+
generator.emitPutById(base.get(), thisValue.get(), m_ident, result.get());
34023404
else
3403-
result = generator.emitPutById(base.get(), m_ident, result.get());
3405+
generator.emitPutById(base.get(), m_ident, result.get());
34043406
generator.emitProfileType(result.get(), divotStart(), divotEnd());
34053407

34063408
generator.emitLabel(afterAssignment.get());
@@ -3479,24 +3481,24 @@ RegisterID* ShortCircuitReadModifyBracketNode::emitBytecode(BytecodeGenerator& g
34793481
RefPtr<RegisterID> property = generator.emitNodeForLeftHandSideForProperty(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
34803482
RefPtr<RegisterID> thisValue;
34813483

3482-
RefPtr<RegisterID> result;
3484+
RefPtr<RegisterID> result = generator.tempDestination(dst);
34833485

34843486
generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
34853487
if (m_base->isSuperNode()) {
34863488
thisValue = generator.ensureThis();
3487-
result = generator.emitGetByVal(generator.tempDestination(dst), base.get(), thisValue.get(), property.get());
3489+
generator.emitGetByVal(result.get(), base.get(), thisValue.get(), property.get());
34883490
} else
3489-
result = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
3491+
generator.emitGetByVal(result.get(), base.get(), property.get());
34903492

34913493
Ref<Label> afterAssignment = generator.newLabel();
34923494
emitShortCircuitAssignment(generator, result.get(), m_operator, afterAssignment.get());
34933495

3494-
result = generator.emitNode(result.get(), m_right);
3496+
generator.emitNode(result.get(), m_right);
34953497
generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
34963498
if (m_base->isSuperNode())
3497-
result = generator.emitPutByVal(base.get(), thisValue.get(), property.get(), result.get());
3499+
generator.emitPutByVal(base.get(), thisValue.get(), property.get(), result.get());
34983500
else
3499-
result = generator.emitPutByVal(base.get(), property.get(), result.get());
3501+
generator.emitPutByVal(base.get(), property.get(), result.get());
35003502
generator.emitProfileType(result.get(), divotStart(), divotEnd());
35013503

35023504
generator.emitLabel(afterAssignment.get());

‎inspector/remote/cocoa/RemoteConnectionToTargetCocoa.mm‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,10 @@ static void RemoteTargetHandleRunSourceWithInfo(void* info)
145145

146146
#if USE(WEB_THREAD)
147147
if (WebCoreWebThreadIsEnabled && WebCoreWebThreadIsEnabled()) {
148-
WebCoreWebThreadRun(^ { callback(); });
148+
__block auto blockCallback(WTFMove(callback));
149+
WebCoreWebThreadRun(^{
150+
blockCallback();
151+
});
149152
return;
150153
}
151154
#endif

‎runtime/JSFunction.cpp‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -398,7 +398,15 @@ JSC_DEFINE_CUSTOM_GETTER(callerGetter, (JSGlobalObject* globalObject, EncodedJSV
398398
if (function->isHostOrBuiltinFunction())
399399
return JSValue::encode(jsNull());
400400

401-
if (!function->jsExecutable()->hasCallerAndArgumentsProperties())
401+
if (function->jsExecutable()->isInStrictContext())
402+
return JSValue::encode(jsNull());
403+
404+
// Prevent bodies (private implementations) of generator / async functions from being exposed.
405+
// They are called by @generatorResume() & friends, expecting certain arguments, and crash otherwise.
406+
// Also, hide generator / async function wrappers for consistency and because it's on standards track:
407+
// https://github.com/claudepache/es-legacy-function-reflection/blob/master/spec.md#get-functionprototypecaller (step 14)
408+
SourceParseMode parseMode = function->jsExecutable()->parseMode();
409+
if (isGeneratorParseMode(parseMode) || isAsyncFunctionParseMode(parseMode))
402410
return JSValue::encode(jsNull());
403411

404412
return JSValue::encode(caller);

0 commit comments

Comments
 (0)