<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197467] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197467">197467</a></dd>
<dt>Author</dt> <dd>sbarati@apple.com</dd>
<dt>Date</dt> <dd>2016-03-02 14:39:02 -0800 (Wed, 02 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[[SetPrototypeOf]] should be a fully virtual method in ClassInfo::methodTable
https://bugs.webkit.org/show_bug.cgi?id=154897
Reviewed by Filip Pizlo.
This patch makes us more consistent with how the ES6 specification models the
[[SetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.[[SetPrototypeOf]]. This patch
still allows directly setting the prototype for situations where this
is the desired behavior. This is equivalent to setting the internal
[[Prototype]] field as described in the specification.
* API/JSClassRef.cpp:
(OpaqueJSClass::prototype):
* API/JSObjectRef.cpp:
(JSObjectMake):
(JSObjectSetPrototype):
(JSObjectHasProperty):
* API/JSWrapperMap.mm:
(makeWrapper):
* runtime/ClassInfo.h:
* runtime/IntlCollatorConstructor.cpp:
(JSC::constructIntlCollator):
* runtime/IntlDateTimeFormatConstructor.cpp:
(JSC::constructIntlDateTimeFormat):
* runtime/IntlNumberFormatConstructor.cpp:
(JSC::constructIntlNumberFormat):
* runtime/JSCell.cpp:
(JSC::JSCell::isExtensible):
(JSC::JSCell::setPrototypeOf):
* runtime/JSCell.h:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::resetPrototype):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncProtoSetter):
* runtime/JSObject.cpp:
(JSC::JSObject::switchToSlowPutArrayStorage):
(JSC::JSObject::setPrototypeDirect):
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::JSObject::setPrototypeOf):
(JSC::JSObject::allowsAccessFrom):
(JSC::JSObject::setPrototype): Deleted.
* runtime/JSObject.h:
(JSC::JSObject::setPrototypeOfInline):
(JSC::JSObject::mayInterceptIndexedAccesses):
* runtime/JSProxy.cpp:
(JSC::JSProxy::setTarget):
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSetPrototypeOf):
* runtime/ReflectObject.cpp:
(JSC::reflectObjectSetPrototypeOf):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreAPIJSClassRefcpp">trunk/Source/JavaScriptCore/API/JSClassRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreAPIJSObjectRefcpp">trunk/Source/JavaScriptCore/API/JSObjectRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreAPIJSWrapperMapmm">trunk/Source/JavaScriptCore/API/JSWrapperMap.mm</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeClassInfoh">trunk/Source/JavaScriptCore/runtime/ClassInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorConstructorcpp">trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatConstructorcpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatConstructorcpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellh">trunk/Source/JavaScriptCore/runtime/JSCell.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSProxycpp">trunk/Source/JavaScriptCore/runtime/JSProxy.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeReflectObjectcpp">trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreAPIJSClassRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSClassRef.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSClassRef.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/API/JSClassRef.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -204,7 +204,7 @@
</span><span class="cx"> JSObject* prototype = JSCallbackObject<JSDestructibleObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
</span><span class="cx"> if (parentClass) {
</span><span class="cx"> if (JSObject* parentPrototype = parentClass->prototype(exec))
</span><del>- prototype->setPrototype(exec->vm(), parentPrototype);
</del><ins>+ prototype->setPrototypeDirect(exec->vm(), parentPrototype);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> jsClassData.cachedPrototype = Weak<JSObject>(prototype);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreAPIJSObjectRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSObjectRef.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/API/JSObjectRef.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -117,7 +117,7 @@
</span><span class="cx">
</span><span class="cx"> JSCallbackObject<JSDestructibleObject>* object = JSCallbackObject<JSDestructibleObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data);
</span><span class="cx"> if (JSObject* prototype = jsClass->prototype(exec))
</span><del>- object->setPrototype(exec->vm(), prototype);
</del><ins>+ object->setPrototypeDirect(exec->vm(), prototype);
</ins><span class="cx">
</span><span class="cx"> return toRef(object);
</span><span class="cx"> }
</span><span class="lines">@@ -291,7 +291,7 @@
</span><span class="cx"> // Someday we might use proxies for something other than JSGlobalObjects, but today is not that day.
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><del>- jsObject->setPrototypeWithCycleCheck(exec, jsValue.isObject() ? jsValue : jsNull());
</del><ins>+ jsObject->setPrototypeOfInline(exec->vm(), exec, jsValue.isObject() ? jsValue : jsNull());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreAPIJSWrapperMapmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSWrapperMap.mm (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSWrapperMap.mm 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/API/JSWrapperMap.mm 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -117,7 +117,7 @@
</span><span class="cx"> JSC::JSCallbackObject<JSC::JSAPIWrapperObject>* object = JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->objcWrapperObjectStructure(), jsClass, 0);
</span><span class="cx"> object->setWrappedObject(wrappedObject);
</span><span class="cx"> if (JSC::JSObject* prototype = jsClass->prototype(exec))
</span><del>- object->setPrototype(exec->vm(), prototype);
</del><ins>+ object->setPrototypeDirect(exec->vm(), prototype);
</ins><span class="cx">
</span><span class="cx"> return object;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -1,5 +1,59 @@
</span><span class="cx"> 2016-03-02 Saam barati <sbarati@apple.com>
</span><span class="cx">
</span><ins>+ [[SetPrototypeOf]] should be a fully virtual method in ClassInfo::methodTable
+ https://bugs.webkit.org/show_bug.cgi?id=154897
+
+ Reviewed by Filip Pizlo.
+
+ This patch makes us more consistent with how the ES6 specification models the
+ [[SetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable
+ is a prerequisite for implementing Proxy.[[SetPrototypeOf]]. This patch
+ still allows directly setting the prototype for situations where this
+ is the desired behavior. This is equivalent to setting the internal
+ [[Prototype]] field as described in the specification.
+
+ * API/JSClassRef.cpp:
+ (OpaqueJSClass::prototype):
+ * API/JSObjectRef.cpp:
+ (JSObjectMake):
+ (JSObjectSetPrototype):
+ (JSObjectHasProperty):
+ * API/JSWrapperMap.mm:
+ (makeWrapper):
+ * runtime/ClassInfo.h:
+ * runtime/IntlCollatorConstructor.cpp:
+ (JSC::constructIntlCollator):
+ * runtime/IntlDateTimeFormatConstructor.cpp:
+ (JSC::constructIntlDateTimeFormat):
+ * runtime/IntlNumberFormatConstructor.cpp:
+ (JSC::constructIntlNumberFormat):
+ * runtime/JSCell.cpp:
+ (JSC::JSCell::isExtensible):
+ (JSC::JSCell::setPrototypeOf):
+ * runtime/JSCell.h:
+ * runtime/JSGlobalObject.cpp:
+ (JSC::JSGlobalObject::resetPrototype):
+ * runtime/JSGlobalObjectFunctions.cpp:
+ (JSC::globalFuncProtoSetter):
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::switchToSlowPutArrayStorage):
+ (JSC::JSObject::setPrototypeDirect):
+ (JSC::JSObject::setPrototypeWithCycleCheck):
+ (JSC::JSObject::setPrototypeOf):
+ (JSC::JSObject::allowsAccessFrom):
+ (JSC::JSObject::setPrototype): Deleted.
+ * runtime/JSObject.h:
+ (JSC::JSObject::setPrototypeOfInline):
+ (JSC::JSObject::mayInterceptIndexedAccesses):
+ * runtime/JSProxy.cpp:
+ (JSC::JSProxy::setTarget):
+ * runtime/ObjectConstructor.cpp:
+ (JSC::objectConstructorSetPrototypeOf):
+ * runtime/ReflectObject.cpp:
+ (JSC::reflectObjectSetPrototypeOf):
+
+2016-03-02 Saam barati <sbarati@apple.com>
+
</ins><span class="cx"> SIGSEGV in Proxy [[Get]] and [[Set]] recursion
</span><span class="cx"> https://bugs.webkit.org/show_bug.cgi?id=154854
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeClassInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ClassInfo.h (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ClassInfo.h 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/ClassInfo.h 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -109,6 +109,9 @@
</span><span class="cx"> typedef bool (*IsExtensibleFunctionPtr)(JSObject*, ExecState*);
</span><span class="cx"> IsExtensibleFunctionPtr isExtensible;
</span><span class="cx">
</span><ins>+ typedef bool (*SetPrototypeOfFunctionPtr)(JSObject*, ExecState*, JSValue);
+ SetPrototypeOfFunctionPtr setPrototypeOf;
+
</ins><span class="cx"> typedef void (*DumpToStreamFunctionPtr)(const JSCell*, PrintStream&);
</span><span class="cx"> DumpToStreamFunctionPtr dumpToStream;
</span><span class="cx">
</span><span class="lines">@@ -162,6 +165,7 @@
</span><span class="cx"> &ClassName::getTypedArrayImpl, \
</span><span class="cx"> &ClassName::preventExtensions, \
</span><span class="cx"> &ClassName::isExtensible, \
</span><ins>+ &ClassName::setPrototypeOf, \
</ins><span class="cx"> &ClassName::dumpToStream, \
</span><span class="cx"> &ClassName::estimatedSize \
</span><span class="cx"> }, \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -97,7 +97,9 @@
</span><span class="cx"> IntlCollator* collator = IntlCollator::create(vm, jsCast<IntlCollatorConstructor*>(state->callee()));
</span><span class="cx"> if (collator && !jsDynamicCast<IntlCollatorConstructor*>(newTarget)) {
</span><span class="cx"> JSValue proto = asObject(newTarget)->getDirect(vm, vm.propertyNames->prototype);
</span><del>- asObject(collator)->setPrototypeWithCycleCheck(state, proto);
</del><ins>+ asObject(collator)->setPrototypeOfInline(vm, state, proto);
+ if (vm.exception())
+ return JSValue::encode(JSValue());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // 3. ReturnIfAbrupt(collator).
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -96,7 +96,9 @@
</span><span class="cx"> IntlDateTimeFormat* dateTimeFormat = IntlDateTimeFormat::create(vm, jsCast<IntlDateTimeFormatConstructor*>(state->callee()));
</span><span class="cx"> if (dateTimeFormat && !jsDynamicCast<IntlDateTimeFormatConstructor*>(newTarget)) {
</span><span class="cx"> JSValue proto = asObject(newTarget)->getDirect(vm, vm.propertyNames->prototype);
</span><del>- asObject(dateTimeFormat)->setPrototypeWithCycleCheck(state, proto);
</del><ins>+ asObject(dateTimeFormat)->setPrototypeOfInline(vm, state, proto);
+ if (vm.exception())
+ return JSValue::encode(JSValue());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // 3. ReturnIfAbrupt(dateTimeFormat).
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -96,7 +96,9 @@
</span><span class="cx"> IntlNumberFormat* numberFormat = IntlNumberFormat::create(vm, jsCast<IntlNumberFormatConstructor*>(state->callee()));
</span><span class="cx"> if (numberFormat && !jsDynamicCast<IntlNumberFormatConstructor*>(newTarget)) {
</span><span class="cx"> JSValue proto = asObject(newTarget)->getDirect(vm, vm.propertyNames->prototype);
</span><del>- asObject(numberFormat)->setPrototypeWithCycleCheck(state, proto);
</del><ins>+ asObject(numberFormat)->setPrototypeOfInline(vm, state, proto);
+ if (vm.exception())
+ return JSValue::encode(JSValue());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // 3. ReturnIfAbrupt(numberFormat).
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -280,4 +280,9 @@
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool JSCell::setPrototypeOf(JSObject*, ExecState*, JSValue)
+{
+ RELEASE_ASSERT_NOT_REACHED();
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.h (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.h 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.h 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -208,6 +208,7 @@
</span><span class="cx"> static NO_RETURN_DUE_TO_CRASH void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
</span><span class="cx"> static NO_RETURN_DUE_TO_CRASH bool preventExtensions(JSObject*, ExecState*);
</span><span class="cx"> static NO_RETURN_DUE_TO_CRASH bool isExtensible(JSObject*, ExecState*);
</span><ins>+ static NO_RETURN_DUE_TO_CRASH bool setPrototypeOf(JSObject*, ExecState*, JSValue);
</ins><span class="cx">
</span><span class="cx"> static String className(const JSObject*);
</span><span class="cx"> JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -807,12 +807,12 @@
</span><span class="cx"> // Set prototype, and also insert the object prototype at the end of the chain.
</span><span class="cx"> void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
</span><span class="cx"> {
</span><del>- setPrototype(vm, prototype);
</del><ins>+ setPrototypeDirect(vm, prototype);
</ins><span class="cx">
</span><span class="cx"> JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
</span><span class="cx"> JSObject* objectPrototype = m_objectPrototype.get();
</span><span class="cx"> if (oldLastInPrototypeChain != objectPrototype)
</span><del>- oldLastInPrototypeChain->setPrototype(vm, objectPrototype);
</del><ins>+ oldLastInPrototypeChain->setPrototypeDirect(vm, objectPrototype);
</ins><span class="cx">
</span><span class="cx"> // Whenever we change the prototype of the global object, we need to create a new JSProxy with the correct prototype.
</span><span class="cx"> setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -891,8 +891,13 @@
</span><span class="cx"> if (!isExtensible)
</span><span class="cx"> return throwVMError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
</span><span class="cx">
</span><del>- if (!thisObject->setPrototypeWithCycleCheck(exec, value))
- exec->vm().throwException(exec, createError(exec, ASCIILiteral("cyclic __proto__ value")));
</del><ins>+ VM& vm = exec->vm();
+ if (!thisObject->setPrototypeOfInline(vm, exec, value)) {
+ if (!vm.exception())
+ vm.throwException(exec, createError(exec, ASCIILiteral("cyclic __proto__ value")));
+ return JSValue::encode(jsUndefined());
+ }
+ ASSERT(!exec->hadException());
</ins><span class="cx"> return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -1171,7 +1171,7 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JSObject::setPrototype(VM& vm, JSValue prototype)
</del><ins>+void JSObject::setPrototypeDirect(VM& vm, JSValue prototype)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(prototype);
</span><span class="cx"> if (prototype.isObject())
</span><span class="lines">@@ -1197,19 +1197,25 @@
</span><span class="cx"> switchToSlowPutArrayStorage(vm);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-bool JSObject::setPrototypeWithCycleCheck(ExecState* exec, JSValue prototype)
</del><ins>+bool JSObject::setPrototypeWithCycleCheck(VM& vm, ExecState* exec, JSValue prototype)
</ins><span class="cx"> {
</span><del>- ASSERT(methodTable(exec->vm())->toThis(this, exec, NotStrictMode) == this);
</del><ins>+ UNUSED_PARAM(exec);
+ ASSERT(methodTable(vm)->toThis(this, exec, NotStrictMode) == this);
</ins><span class="cx"> JSValue nextPrototype = prototype;
</span><span class="cx"> while (nextPrototype && nextPrototype.isObject()) {
</span><span class="cx"> if (nextPrototype == this)
</span><span class="cx"> return false;
</span><span class="cx"> nextPrototype = asObject(nextPrototype)->prototype();
</span><span class="cx"> }
</span><del>- setPrototype(exec->vm(), prototype);
</del><ins>+ setPrototypeDirect(vm, prototype);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool JSObject::setPrototypeOf(JSObject* object, ExecState* exec, JSValue prototype)
+{
+ return object->setPrototypeWithCycleCheck(exec->vm(), exec, prototype);
+}
+
</ins><span class="cx"> bool JSObject::allowsAccessFrom(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx"> JSGlobalObject* globalObject = this->globalObject();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -103,8 +103,31 @@
</span><span class="cx"> JS_EXPORT_PRIVATE static String calculatedClassName(JSObject*);
</span><span class="cx">
</span><span class="cx"> JSValue prototype() const;
</span><del>- JS_EXPORT_PRIVATE void setPrototype(VM&, JSValue prototype);
- JS_EXPORT_PRIVATE bool setPrototypeWithCycleCheck(ExecState*, JSValue prototype);
</del><ins>+ // This sets the prototype without checking for cycles and without
+ // doing dynamic dispatch on [[SetPrototypeOf]] operation in the specification.
+ // It is not valid to use this when performing a [[SetPrototypeOf]] operation in
+ // the specification. It is valid to use though when you know that you want to directly
+ // set it without consulting the method table and when you definitely won't
+ // introduce a cycle in the prototype chain. This is akin to setting the
+ // [[Prototype]] internal field directly as described in the specification.
+ JS_EXPORT_PRIVATE void setPrototypeDirect(VM&, JSValue prototype);
+private:
+ // This is OrdinarySetPrototypeOf in the specification. Section 9.1.2.1
+ // https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof
+ JS_EXPORT_PRIVATE bool setPrototypeWithCycleCheck(VM&, ExecState*, JSValue prototype);
+public:
+ // This is the fully virtual [[SetPrototypeOf]] internal function defined
+ // in the ECMAScript 6 specification. Use this when doing a [[SetPrototypeOf]]
+ // operation as dictated in the specification.
+ ALWAYS_INLINE bool setPrototypeOfInline(VM& vm, ExecState* exec, JSValue prototype)
+ {
+ auto setPrototypeOfMethod = methodTable(vm)->setPrototypeOf;
+ if (LIKELY(setPrototypeOfMethod == JSObject::setPrototypeOf))
+ return setPrototypeWithCycleCheck(vm, exec, prototype);
+
+ return setPrototypeOfMethod(this, exec, prototype);
+ }
+ JS_EXPORT_PRIVATE static bool setPrototypeOf(JSObject*, ExecState*, JSValue prototype);
</ins><span class="cx">
</span><span class="cx"> bool mayInterceptIndexedAccesses()
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSProxycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSProxy.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSProxy.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/JSProxy.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT_ARG(globalObject, globalObject);
</span><span class="cx"> m_target.set(vm, this, globalObject);
</span><del>- setPrototype(vm, globalObject->prototype());
</del><ins>+ setPrototypeDirect(vm, globalObject->prototype());
</ins><span class="cx">
</span><span class="cx"> PrototypeMap& prototypeMap = vm.prototypeMap;
</span><span class="cx"> if (!prototypeMap.isPrototype(this))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -218,8 +218,12 @@
</span><span class="cx"> if (!isExtensible)
</span><span class="cx"> return throwVMError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
</span><span class="cx">
</span><del>- if (!object->setPrototypeWithCycleCheck(exec, protoValue)) {
- exec->vm().throwException(exec, createError(exec, ASCIILiteral("cyclic __proto__ value")));
</del><ins>+ VM& vm = exec->vm();
+ bool didSetPrototype = object->setPrototypeOfInline(vm, exec, protoValue);
+ if (vm.exception())
+ return JSValue::encode(JSValue());
+ if (!didSetPrototype) {
+ vm.throwException(exec, createError(exec, ASCIILiteral("cyclic __proto__ value")));
</ins><span class="cx"> return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeReflectObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp (197466 => 197467)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp 2016-03-02 22:37:57 UTC (rev 197466)
+++ trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp 2016-03-02 22:39:02 UTC (rev 197467)
</span><span class="lines">@@ -221,7 +221,11 @@
</span><span class="cx"> if (!isExtensible)
</span><span class="cx"> return JSValue::encode(jsBoolean(false));
</span><span class="cx">
</span><del>- return JSValue::encode(jsBoolean(object->setPrototypeWithCycleCheck(exec, proto)));
</del><ins>+ VM& vm = exec->vm();
+ bool didSetPrototype = object->setPrototypeOfInline(vm, exec, proto);
+ if (vm.exception())
+ return JSValue::encode(JSValue());
+ return JSValue::encode(jsBoolean(didSetPrototype));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre>
</div>
</div>
</body>
</html>