[webkit-changes] [WebKit/WebKit] 536ac3: [JSC] putDirectWithReify() should not cache puttin...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 536ac3a29fccd9f597f47ed43377a4ad70f22ba2
      https://github.com/WebKit/WebKit/commit/536ac3a29fccd9f597f47ed43377a4ad70f22ba2
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2024-08-06 (Tue, 06 Aug 2024)

  Changed paths:
    A JSTests/stress/regress-125602977.js
    M Source/JavaScriptCore/runtime/CommonSlowPaths.h

  Log Message:
  -----------
  [JSC] putDirectWithReify() should not cache putting `prototype` to a JSFunction
https://bugs.webkit.org/show_bug.cgi?id=273580
<rdar://125602977>

Reviewed by Yusuke Suzuki.

Before this change, putDirectWithReify() used for direct op_put_by_id could still cache putting of
`prototype` properties. Leveraging the cache, one could put a configurable `prototype` property onto
a JSFunction with mayHaveNonReifiedPrototype() returning true. And because of configurability, it could
have been turned into a GetterSetter and leaked via getDirect() in JSFunction::getOwnPropertySlot(),
breaking the method's assumption that the `prototype` a JSFunction with thruthy mayHaveNonReifiedPrototype()
must be a value.

This change prevents put slot from being cached, and clears FunctionRareData like it's done in other
methods that put `prototype` property.

* JSTests/stress/regress-125602977.js: Added.
* Source/JavaScriptCore/runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::putDirectWithReify):
(JSC::CommonSlowPaths::putDirectAccessorWithReify):

Originally-landed-as: 272448.1012 at safari-7618-branch (283802946dcc). rdar://133089383
Canonical link: https://commits.webkit.org/281897@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications