Skip to content

Commit 57f026f

Browse files
apple-opensourceapple-opensource
committed
7606.4.5
1 parent 4e5b559 commit 57f026f

21 files changed

+302
-38
lines changed

‎ChangeLog‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,190 @@
1+
2018-12-10 Mark Lam <mark.lam@apple.com>
2+
3+
Cherry-pick r239062. rdar://problem/46603464
4+
5+
2018-12-10 Mark Lam <mark.lam@apple.com>
6+
7+
PropertyAttribute needs a CustomValue bit.
8+
https://bugs.webkit.org/show_bug.cgi?id=191993
9+
<rdar://problem/46264467>
10+
11+
Reviewed by Saam Barati.
12+
13+
This is because GetByIdStatus needs to distinguish CustomValue properties from
14+
other types, and its only means of doing so is via the property's attributes.
15+
Previously, there's nothing in the property's attributes that can indicate that
16+
the property is a CustomValue.
17+
18+
We fix this by doing the following:
19+
20+
1. Added a PropertyAttribute::CustomValue bit.
21+
2. Added a PropertyAttribute::CustomAccessorOrValue convenience bit mask that is
22+
CustomAccessor | CustomValue.
23+
24+
3. Since CustomGetterSetter properties are only set via JSObject::putDirectCustomAccessor(),
25+
we added a check in JSObject::putDirectCustomAccessor() to see if the attributes
26+
bits include PropertyAttribute::CustomAccessor. If not, then the property
27+
must be a CustomValue, and we'll add the PropertyAttribute::CustomValue bit
28+
to the attributes bits.
29+
30+
This ensures that the property attributes is sufficient to tell us if the
31+
property contains a CustomGetterSetter.
32+
33+
4. Updated all checks for PropertyAttribute::CustomAccessor to check for
34+
PropertyAttribute::CustomAccessorOrValue instead if their intent is to check
35+
for the presence of a CustomGetterSetter as opposed to checking specifically
36+
for one that is used as a CustomAccessor.
37+
38+
This includes all the Structure transition code that needs to capture the
39+
attributes change when a CustomValue has been added.
40+
41+
5. Filtered out the PropertyAttribute::CustomValue bit in PropertyDescriptor.
42+
The fact that we're using a CustomGetterSetter as a CustomValue should remain
43+
invisible to the descriptor. This is because the descriptor should describe
44+
a CustomValue no differently from a plain value.
45+
46+
6. Added some asserts to ensure that property attributes are as expected, and to
47+
document some invariants.
48+
49+
* bytecode/GetByIdStatus.cpp:
50+
(JSC::GetByIdStatus::computeFromLLInt):
51+
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
52+
(JSC::GetByIdStatus::computeFor):
53+
* bytecode/InByIdStatus.cpp:
54+
(JSC::InByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
55+
* bytecode/PropertyCondition.cpp:
56+
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
57+
* bytecode/PutByIdStatus.cpp:
58+
(JSC::PutByIdStatus::computeFor):
59+
* runtime/JSFunction.cpp:
60+
(JSC::getCalculatedDisplayName):
61+
* runtime/JSObject.cpp:
62+
(JSC::JSObject::putDirectCustomAccessor):
63+
(JSC::JSObject::putDirectNonIndexAccessor):
64+
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
65+
* runtime/JSObject.h:
66+
(JSC::JSObject::putDirectIndex):
67+
(JSC::JSObject::fillCustomGetterPropertySlot):
68+
(JSC::JSObject::putDirect):
69+
* runtime/JSObjectInlines.h:
70+
(JSC::JSObject::putDirectInternal):
71+
* runtime/PropertyDescriptor.cpp:
72+
(JSC::PropertyDescriptor::setDescriptor):
73+
(JSC::PropertyDescriptor::setCustomDescriptor):
74+
(JSC::PropertyDescriptor::setAccessorDescriptor):
75+
* runtime/PropertySlot.h:
76+
(JSC::PropertySlot::setCustomGetterSetter):
77+
78+
2018-11-26 Alan Coon <alancoon@apple.com>
79+
80+
Cherry-pick r238326. rdar://problem/46259215
81+
82+
All users of ArrayBuffer should agree on the same max size
83+
https://bugs.webkit.org/show_bug.cgi?id=191771
84+
85+
Reviewed by Mark Lam.
86+
87+
JSTests:
88+
89+
* stress/big-wasm-memory-grow-no-max.js: Added.
90+
(foo):
91+
(catch):
92+
* stress/big-wasm-memory-grow.js: Added.
93+
(foo):
94+
(catch):
95+
* stress/big-wasm-memory.js: Added.
96+
(foo):
97+
(catch):
98+
99+
Source/JavaScriptCore:
100+
101+
Array buffers cannot be larger than 0x7fffffff, because otherwise loading typedArray.length in the DFG/FTL would produce
102+
a uint32 or would require a signedness check, neither of which sounds reasonable. It's better to just bound their max size
103+
instead.
104+
105+
* runtime/ArrayBuffer.cpp:
106+
(JSC::ArrayBufferContents::ArrayBufferContents):
107+
(JSC::ArrayBufferContents::tryAllocate):
108+
(JSC::ArrayBufferContents::transferTo):
109+
(JSC::ArrayBufferContents::copyTo):
110+
(JSC::ArrayBufferContents::shareWith):
111+
* runtime/ArrayBuffer.h:
112+
* wasm/WasmMemory.cpp:
113+
(JSC::Wasm::Memory::tryCreate):
114+
(JSC::Wasm::Memory::grow):
115+
* wasm/WasmPageCount.h:
116+
117+
118+
119+
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@238326 268f45cc-cd09-0410-ab3c-d52691b4dbfc
120+
121+
2018-11-16 Filip Pizlo <fpizlo@apple.com>
122+
123+
All users of ArrayBuffer should agree on the same max size
124+
https://bugs.webkit.org/show_bug.cgi?id=191771
125+
126+
Reviewed by Mark Lam.
127+
128+
Array buffers cannot be larger than 0x7fffffff, because otherwise loading typedArray.length in the DFG/FTL would produce
129+
a uint32 or would require a signedness check, neither of which sounds reasonable. It's better to just bound their max size
130+
instead.
131+
132+
* runtime/ArrayBuffer.cpp:
133+
(JSC::ArrayBufferContents::ArrayBufferContents):
134+
(JSC::ArrayBufferContents::tryAllocate):
135+
(JSC::ArrayBufferContents::transferTo):
136+
(JSC::ArrayBufferContents::copyTo):
137+
(JSC::ArrayBufferContents::shareWith):
138+
* runtime/ArrayBuffer.h:
139+
* wasm/WasmMemory.cpp:
140+
(JSC::Wasm::Memory::tryCreate):
141+
(JSC::Wasm::Memory::grow):
142+
* wasm/WasmPageCount.h:
143+
144+
2018-11-15 Mark Lam <mark.lam@apple.com>
145+
146+
Cherry-pick r238270. rdar://problem/46085279
147+
148+
2018-11-15 Mark Lam <mark.lam@apple.com>
149+
150+
RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
151+
https://bugs.webkit.org/show_bug.cgi?id=191730
152+
<rdar://problem/46048517>
153+
154+
Reviewed by Saam Barati.
155+
156+
According to the spec https://www.ecma-international.org/ecma-262/9.0/index.html#sec-regexp.prototype-@@match,
157+
the RegExp match results are filled in using the spec's CreateDataProperty()
158+
function which does not consult the prototype for setters. JSArray:push()
159+
consults the prototype for setters. We should be using putDirectIndex() instead.
160+
161+
* runtime/RegExpObjectInlines.h:
162+
(JSC::collectMatches):
163+
164+
2018-11-15 Mark Lam <mark.lam@apple.com>
165+
166+
Cherry-pick r238267. rdar://problem/46032438
167+
168+
2018-11-15 Mark Lam <mark.lam@apple.com>
169+
170+
RegExp operations should not take fast patch if lastIndex is not numeric.
171+
https://bugs.webkit.org/show_bug.cgi?id=191731
172+
<rdar://problem/46017305>
173+
174+
Reviewed by Saam Barati.
175+
176+
This is because if lastIndex is an object with a valueOf() method, it can execute
177+
arbitrary code which may have side effects, and side effects are not permitted by
178+
the RegExp fast paths.
179+
180+
* builtins/RegExpPrototype.js:
181+
(globalPrivate.hasObservableSideEffectsForRegExpMatch):
182+
(overriddenName.string_appeared_here.search):
183+
(globalPrivate.hasObservableSideEffectsForRegExpSplit):
184+
(intrinsic.RegExpTestIntrinsic.test):
185+
* builtins/StringPrototype.js:
186+
(globalPrivate.hasObservableSideEffectsForStringReplace):
187+
1188
2018-10-28 Babak Shafiei <bshafiei@apple.com>
2189

3190
Cherry-pick r237325. rdar://problem/45363533

‎Configurations/Version.xcconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@
2222
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2323

2424
MAJOR_VERSION = 606;
25-
MINOR_VERSION = 3;
26-
TINY_VERSION = 4;
25+
MINOR_VERSION = 4;
26+
TINY_VERSION = 5;
2727
MICRO_VERSION = 0;
2828
NANO_VERSION = 0;
2929
FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);

‎builtins/RegExpPrototype.js‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2016 Apple Inc. All rights reserved.
2+
* Copyright (C) 2016-2018 Apple Inc. All rights reserved.
33
*
44
* Redistribution and use in source and binary forms, with or without
55
* modification, are permitted provided that the following conditions
@@ -67,6 +67,9 @@ function hasObservableSideEffectsForRegExpMatch(regexp)
6767
{
6868
"use strict";
6969

70+
if (!@isRegExpObject(regexp))
71+
return true;
72+
7073
// This is accessed by the RegExpExec internal function.
7174
let regexpExec = @tryGetById(regexp, "exec");
7275
if (regexpExec !== @regExpBuiltinExec)
@@ -79,7 +82,7 @@ function hasObservableSideEffectsForRegExpMatch(regexp)
7982
if (regexpUnicode !== @regExpProtoUnicodeGetter)
8083
return true;
8184

82-
return !@isRegExpObject(regexp);
85+
return typeof regexp.lastIndex !== "number";
8386
}
8487

8588
@globalPrivate
@@ -315,7 +318,9 @@ function search(strArg)
315318
let regexp = this;
316319

317320
// Check for observable side effects and call the fast path if there aren't any.
318-
if (@isRegExpObject(regexp) && @tryGetById(regexp, "exec") === @regExpBuiltinExec)
321+
if (@isRegExpObject(regexp)
322+
&& @tryGetById(regexp, "exec") === @regExpBuiltinExec
323+
&& typeof regexp.lastIndex === "number")
319324
return @regExpSearchFast.@call(regexp, strArg);
320325

321326
// 1. Let rx be the this value.
@@ -358,6 +363,9 @@ function hasObservableSideEffectsForRegExpSplit(regexp)
358363
{
359364
"use strict";
360365

366+
if (!@isRegExpObject(regexp))
367+
return true;
368+
361369
// This is accessed by the RegExpExec internal function.
362370
let regexpExec = @tryGetById(regexp, "exec");
363371
if (regexpExec !== @regExpBuiltinExec)
@@ -389,8 +397,8 @@ function hasObservableSideEffectsForRegExpSplit(regexp)
389397
let regexpSource = @tryGetById(regexp, "source");
390398
if (regexpSource !== @regExpProtoSourceGetter)
391399
return true;
392-
393-
return !@isRegExpObject(regexp);
400+
401+
return typeof regexp.lastIndex !== "number";
394402
}
395403

396404
// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
@@ -536,7 +544,9 @@ function test(strArg)
536544
let regexp = this;
537545

538546
// Check for observable side effects and call the fast path if there aren't any.
539-
if (@isRegExpObject(regexp) && @tryGetById(regexp, "exec") === @regExpBuiltinExec)
547+
if (@isRegExpObject(regexp)
548+
&& @tryGetById(regexp, "exec") === @regExpBuiltinExec
549+
&& typeof regexp.lastIndex === "number")
540550
return @regExpTestFast.@call(regexp, strArg);
541551

542552
// 1. Let R be the this value.

‎builtins/StringPrototype.js‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/*
22
* Copyright (C) 2015 Andy VanWagoner <andy@vanwagoner.family>.
33
* Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
4-
* Copyright (C) 2016 Apple Inc. All rights reserved.
4+
* Copyright (C) 2016-2018 Apple Inc. All rights reserved.
55
*
66
* Redistribution and use in source and binary forms, with or without
77
* modification, are permitted provided that the following conditions
@@ -195,6 +195,9 @@ function hasObservableSideEffectsForStringReplace(regexp, replacer)
195195
{
196196
"use strict";
197197

198+
if (!@isRegExpObject(regexp))
199+
return true;
200+
198201
if (replacer !== @regExpPrototypeSymbolReplace)
199202
return true;
200203

@@ -210,7 +213,7 @@ function hasObservableSideEffectsForStringReplace(regexp, replacer)
210213
if (regexpUnicode !== @regExpProtoUnicodeGetter)
211214
return true;
212215

213-
return !@isRegExpObject(regexp);
216+
return typeof regexp.lastIndex !== "number";
214217
}
215218

216219
@intrinsic=StringPrototypeReplaceIntrinsic

‎bytecode/GetByIdStatus.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
8383
PropertyOffset offset = structure->getConcurrently(uid, attributes);
8484
if (!isValidOffset(offset))
8585
return GetByIdStatus(NoInformation, false);
86-
if (attributes & PropertyAttribute::CustomAccessor)
86+
if (attributes & PropertyAttribute::CustomAccessorOrValue)
8787
return GetByIdStatus(NoInformation, false);
8888

8989
return GetByIdStatus(Simple, false, GetByIdVariant(StructureSet(structure), offset));
@@ -190,7 +190,7 @@ GetByIdStatus GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
190190
variant.m_offset = structure->getConcurrently(uid, attributes);
191191
if (!isValidOffset(variant.m_offset))
192192
return GetByIdStatus(slowPathState, true);
193-
if (attributes & PropertyAttribute::CustomAccessor)
193+
if (attributes & PropertyAttribute::CustomAccessorOrValue)
194194
return GetByIdStatus(slowPathState, true);
195195

196196
variant.m_structureSet.add(structure);
@@ -382,7 +382,7 @@ GetByIdStatus GetByIdStatus::computeFor(const StructureSet& set, UniquedStringIm
382382
return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
383383
if (attributes & PropertyAttribute::Accessor)
384384
return GetByIdStatus(MakesCalls); // We could be smarter here, like strength-reducing this to a Call.
385-
if (attributes & PropertyAttribute::CustomAccessor)
385+
if (attributes & PropertyAttribute::CustomAccessorOrValue)
386386
return GetByIdStatus(TakesSlowPath);
387387

388388
if (!result.appendVariant(GetByIdVariant(structure, offset)))

‎bytecode/InByIdStatus.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ InByIdStatus InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(const Concu
139139
variant.m_offset = structure->getConcurrently(uid, attributes);
140140
if (!isValidOffset(variant.m_offset))
141141
return InByIdStatus(TakesSlowPath);
142-
if (attributes & PropertyAttribute::CustomAccessor)
142+
if (attributes & PropertyAttribute::CustomAccessorOrValue)
143143
return InByIdStatus(TakesSlowPath);
144144

145145
variant.m_structureSet.add(structure);

‎bytecode/PropertyCondition.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ bool PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint(
161161
unsigned currentAttributes;
162162
PropertyOffset currentOffset = structure->getConcurrently(uid(), currentAttributes);
163163
if (currentOffset != invalidOffset) {
164-
if (currentAttributes & (PropertyAttribute::ReadOnly | PropertyAttribute::Accessor | PropertyAttribute::CustomAccessor)) {
164+
if (currentAttributes & (PropertyAttribute::ReadOnly | PropertyAttribute::Accessor | PropertyAttribute::CustomAccessorOrValue)) {
165165
if (PropertyConditionInternal::verbose) {
166166
dataLog(
167167
"Invalid because we expected not to have a setter, but we have one at offset ",

‎bytecode/PutByIdStatus.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,7 @@ PutByIdStatus PutByIdStatus::computeFor(JSGlobalObject* globalObject, const Stru
321321
unsigned attributes;
322322
PropertyOffset offset = structure->getConcurrently(uid, attributes);
323323
if (isValidOffset(offset)) {
324-
if (attributes & PropertyAttribute::CustomAccessor)
324+
if (attributes & PropertyAttribute::CustomAccessorOrValue)
325325
return PutByIdStatus(MakesCalls);
326326

327327
if (attributes & (PropertyAttribute::Accessor | PropertyAttribute::ReadOnly))

0 commit comments

Comments
 (0)