<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[212015] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/212015">212015</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2017-02-09 17:39:13 -0800 (Thu, 09 Feb 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>Constructed object's global object should be the global object of the constructor.
https://bugs.webkit.org/show_bug.cgi?id=167121
<rdar://problem/30054759>
Patch by Mark Lam <mark.lam@apple.com> on 2017-02-09
Reviewed by Filip Pizlo and Geoffrey Garen.
Source/JavaScriptCore:
The realm (i.e. globalObject) of any object should be the same as the constructor
that instantiated the object. Changed PrototypeMap::createEmptyStructure() to
be passed the correct globalObject to use instead of assuming it's the same one
as the prototype object.
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
* bytecode/InternalFunctionAllocationProfile.h:
(JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
* bytecode/ObjectAllocationProfile.h:
(JSC::ObjectAllocationProfile::initialize):
* runtime/FunctionRareData.cpp:
(JSC::FunctionRareData::initializeObjectAllocationProfile):
* runtime/FunctionRareData.h:
(JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase):
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::createSubclassStructure):
* runtime/IteratorOperations.cpp:
(JSC::createIteratorResultObjectStructure):
* runtime/JSBoundFunction.cpp:
(JSC::getBoundFunctionStructure):
* runtime/JSFunction.cpp:
(JSC::JSFunction::allocateAndInitializeRareData):
(JSC::JSFunction::initializeRareData):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/JSProxy.cpp:
(JSC::JSProxy::setTarget):
* runtime/ObjectConstructor.h:
(JSC::constructEmptyObject):
* runtime/PrototypeMap.cpp:
(JSC::PrototypeMap::createEmptyStructure):
(JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
(JSC::PrototypeMap::emptyObjectStructureForPrototype):
(JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
* runtime/PrototypeMap.h:
LayoutTests:
* http/tests/security/xssAuditor/regress-167121-expected.txt: Added.
* http/tests/security/xssAuditor/regress-167121.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeInternalFunctionAllocationProfileh">trunk/Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeObjectAllocationProfileh">trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionRareDatacpp">trunk/Source/JavaScriptCore/runtime/FunctionRareData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionRareDatah">trunk/Source/JavaScriptCore/runtime/FunctionRareData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeInternalFunctioncpp">trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIteratorOperationscpp">trunk/Source/JavaScriptCore/runtime/IteratorOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSProxycpp">trunk/Source/JavaScriptCore/runtime/JSProxy.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorh">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePrototypeMapcpp">trunk/Source/JavaScriptCore/runtime/PrototypeMap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePrototypeMaph">trunk/Source/JavaScriptCore/runtime/PrototypeMap.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestshttptestssecurityxssAuditorregress167121expectedtxt">trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecurityxssAuditorregress167121html">trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/LayoutTests/ChangeLog 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2017-02-09 Mark Lam <mark.lam@apple.com>
+
+ Constructed object's global object should be the global object of the constructor.
+ https://bugs.webkit.org/show_bug.cgi?id=167121
+ <rdar://problem/30054759>
+
+ Reviewed by Filip Pizlo and Geoffrey Garen.
+
+ * http/tests/security/xssAuditor/regress-167121-expected.txt: Added.
+ * http/tests/security/xssAuditor/regress-167121.html: Added.
+
</ins><span class="cx"> 2017-02-09 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> REGRESSION: LayoutTest http/tests/cache/disk-cache/disk-cache-remove-several-pending-writes.html is a flaky failure
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecurityxssAuditorregress167121expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121-expected.txt (0 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121-expected.txt 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+CONSOLE MESSAGE: line 2: .../security/xssAuditor/regress-167121.html
+This tests that the URL of an iframe whose page triggered a full page block is not "data:,".
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecurityxssAuditorregress167121html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121.html (0 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/xssAuditor/regress-167121.html 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -0,0 +1,51 @@
</span><ins>+<body>
+<!DOCTYPE html>
+<html>
+<head>
+<script src="/resources/js-test-pre.js"></script>
+<script>
+if (window.testRunner)
+ testRunner.setXSSAuditorEnabled(true);
+
+window.jsTestIsAsync = true;
+
+var frame;
+var locationStr;
+
+function runTest()
+{
+ function loadDifferentURL()
+ {
+ frame.onload = null;
+
+ let g = function () {};
+ g.prototype = frame.contentWindow;
+
+ let a = Reflect.construct(Intl.NumberFormat, [], g);
+ try {
+ Intl.NumberFormat.prototype.__lookupGetter__("format").call(a).constructor('var str = String(location); var i = str.search("security/xssAuditor"); console.log(".../" + str.substr(i))')();
+ } catch (e) {
+ console.log("Caught: " + e);
+ }
+
+ finishJSTest();
+ }
+ frame.onload = loadDifferentURL;
+ frame.src = "http://localhost:8000/security/xssAuditor/resources/echo-dom-write-location.html"
+}
+
+window.onload = function ()
+{
+ frame = document.getElementById("frame");
+ runTest();
+}
+</script>
+</head>
+<body>
+ <script>
+ description("This tests that the URL of an iframe whose page triggered a full page block is not &quot;data:,&quot;.");
+ </script>
+ <iframe id="frame"></iframe>
+ <script src="/resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/ChangeLog 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,3 +1,48 @@
</span><ins>+2017-02-09 Mark Lam <mark.lam@apple.com>
+
+ Constructed object's global object should be the global object of the constructor.
+ https://bugs.webkit.org/show_bug.cgi?id=167121
+ <rdar://problem/30054759>
+
+ Reviewed by Filip Pizlo and Geoffrey Garen.
+
+ The realm (i.e. globalObject) of any object should be the same as the constructor
+ that instantiated the object. Changed PrototypeMap::createEmptyStructure() to
+ be passed the correct globalObject to use instead of assuming it's the same one
+ as the prototype object.
+
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::finishCreation):
+ * bytecode/InternalFunctionAllocationProfile.h:
+ (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
+ * bytecode/ObjectAllocationProfile.h:
+ (JSC::ObjectAllocationProfile::initialize):
+ * runtime/FunctionRareData.cpp:
+ (JSC::FunctionRareData::initializeObjectAllocationProfile):
+ * runtime/FunctionRareData.h:
+ (JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase):
+ * runtime/InternalFunction.cpp:
+ (JSC::InternalFunction::createSubclassStructure):
+ * runtime/IteratorOperations.cpp:
+ (JSC::createIteratorResultObjectStructure):
+ * runtime/JSBoundFunction.cpp:
+ (JSC::getBoundFunctionStructure):
+ * runtime/JSFunction.cpp:
+ (JSC::JSFunction::allocateAndInitializeRareData):
+ (JSC::JSFunction::initializeRareData):
+ * runtime/JSGlobalObject.cpp:
+ (JSC::JSGlobalObject::init):
+ * runtime/JSProxy.cpp:
+ (JSC::JSProxy::setTarget):
+ * runtime/ObjectConstructor.h:
+ (JSC::constructEmptyObject):
+ * runtime/PrototypeMap.cpp:
+ (JSC::PrototypeMap::createEmptyStructure):
+ (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
+ (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+ (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
+ * runtime/PrototypeMap.h:
+
</ins><span class="cx"> 2017-02-09 Keith Miller <keith_miller@apple.com>
</span><span class="cx">
</span><span class="cx"> We should not allow Function.caller to be used on native functions
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2010, 2012-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -2120,7 +2120,7 @@
</span><span class="cx">
</span><span class="cx"> instructions[i + opLength - 1] = objectAllocationProfile;
</span><span class="cx"> objectAllocationProfile->initialize(vm,
</span><del>- this, m_globalObject->objectPrototype(), inferredInlineCapacity);
</del><ins>+ m_globalObject.get(), this, m_globalObject->objectPrototype(), inferredInlineCapacity);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeInternalFunctionAllocationProfileh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx"> class InternalFunctionAllocationProfile {
</span><span class="cx"> public:
</span><span class="cx"> Structure* structure() { return m_structure.get(); }
</span><del>- Structure* createAllocationStructureFromBase(VM&, JSCell* owner, JSObject* prototype, Structure* base);
</del><ins>+ Structure* createAllocationStructureFromBase(VM&, JSGlobalObject*, JSCell* owner, JSObject* prototype, Structure* base);
</ins><span class="cx">
</span><span class="cx"> void clear() { m_structure.clear(); }
</span><span class="cx"> void visitAggregate(SlotVisitor& visitor) { visitor.append(m_structure); }
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx"> WriteBarrier<Structure> m_structure;
</span><span class="cx"> };
</span><span class="cx">
</span><del>-inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSCell* owner, JSObject* prototype, Structure* baseStructure)
</del><ins>+inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* globalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo());
</span><span class="cx">
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx"> if (prototype == baseStructure->storedPrototype())
</span><span class="cx"> structure = baseStructure;
</span><span class="cx"> else
</span><del>- structure = vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseStructure);
</del><ins>+ structure = vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(globalObject, prototype, baseStructure);
</ins><span class="cx">
</span><span class="cx"> // Ensure that if another thread sees the structure, it will see it properly created.
</span><span class="cx"> WTF::storeStoreFence();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeObjectAllocationProfileh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx">
</span><span class="cx"> bool isNull() { return !m_structure; }
</span><span class="cx">
</span><del>- void initialize(VM& vm, JSCell* owner, JSObject* prototype, unsigned inferredInlineCapacity)
</del><ins>+ void initialize(VM& vm, JSGlobalObject* globalObject, JSCell* owner, JSObject* prototype, unsigned inferredInlineCapacity)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(!m_allocator);
</span><span class="cx"> ASSERT(!m_structure);
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx"> inlineCapacity = JSFinalObject::maxInlineCapacity();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- Structure* structure = vm.prototypeMap.emptyObjectStructureForPrototype(prototype, inlineCapacity);
</del><ins>+ Structure* structure = vm.prototypeMap.emptyObjectStructureForPrototype(globalObject, prototype, inlineCapacity);
</ins><span class="cx">
</span><span class="cx"> // Ensure that if another thread sees the structure, it will see it properly created
</span><span class="cx"> WTF::storeStoreFence();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionRareDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionRareData.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionRareData.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/FunctionRareData.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -79,9 +79,9 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void FunctionRareData::initializeObjectAllocationProfile(VM& vm, JSObject* prototype, size_t inlineCapacity)
</del><ins>+void FunctionRareData::initializeObjectAllocationProfile(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, size_t inlineCapacity)
</ins><span class="cx"> {
</span><del>- m_objectAllocationProfile.initialize(vm, this, prototype, inlineCapacity);
</del><ins>+ m_objectAllocationProfile.initialize(vm, globalObject, this, prototype, inlineCapacity);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void FunctionRareData::clear(const char* reason)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionRareDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionRareData.h (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionRareData.h 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/FunctionRareData.h 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -79,14 +79,14 @@
</span><span class="cx">
</span><span class="cx"> void clear(const char* reason);
</span><span class="cx">
</span><del>- void initializeObjectAllocationProfile(VM&, JSObject* prototype, size_t inlineCapacity);
</del><ins>+ void initializeObjectAllocationProfile(VM&, JSGlobalObject*, JSObject* prototype, size_t inlineCapacity);
</ins><span class="cx">
</span><span class="cx"> bool isObjectAllocationProfileInitialized() { return !m_objectAllocationProfile.isNull(); }
</span><span class="cx">
</span><span class="cx"> Structure* internalFunctionAllocationStructure() { return m_internalFunctionAllocationProfile.structure(); }
</span><del>- Structure* createInternalFunctionAllocationStructureFromBase(VM& vm, JSObject* prototype, Structure* baseStructure)
</del><ins>+ Structure* createInternalFunctionAllocationStructureFromBase(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, Structure* baseStructure)
</ins><span class="cx"> {
</span><del>- return m_internalFunctionAllocationProfile.createAllocationStructureFromBase(vm, this, prototype, baseStructure);
</del><ins>+ return m_internalFunctionAllocationProfile.createAllocationStructureFromBase(vm, globalObject, this, prototype, baseStructure);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Structure* getBoundFunctionStructure() { return m_boundFunctionStructure.get(); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeInternalFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
</span><span class="cx"> * Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2004, 2007-2008, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004, 2007-2008, 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -105,6 +105,7 @@
</span><span class="cx"> if (newTarget && newTarget != exec->jsCallee()) {
</span><span class="cx"> // newTarget may be an InternalFunction if we were called from Reflect.construct.
</span><span class="cx"> JSFunction* targetFunction = jsDynamicCast<JSFunction*>(vm, newTarget);
</span><ins>+ JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
</ins><span class="cx">
</span><span class="cx"> if (LIKELY(targetFunction)) {
</span><span class="cx"> Structure* structure = targetFunction->rareData(vm)->internalFunctionAllocationStructure();
</span><span class="lines">@@ -115,7 +116,7 @@
</span><span class="cx"> JSValue prototypeValue = newTarget.get(exec, exec->propertyNames().prototype);
</span><span class="cx"> RETURN_IF_EXCEPTION(scope, nullptr);
</span><span class="cx"> if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue))
</span><del>- return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass);
</del><ins>+ return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, lexicalGlobalObject, prototype, baseClass);
</ins><span class="cx"> } else {
</span><span class="cx"> JSValue prototypeValue = newTarget.get(exec, exec->propertyNames().prototype);
</span><span class="cx"> RETURN_IF_EXCEPTION(scope, nullptr);
</span><span class="lines">@@ -122,7 +123,7 @@
</span><span class="cx"> if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue)) {
</span><span class="cx"> // This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.
</span><span class="cx"> // Thus, we don't care about the cost of looking up the structure from our hash table every time.
</span><del>- return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass);
</del><ins>+ return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(lexicalGlobalObject, prototype, baseClass);
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIteratorOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IteratorOperations.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IteratorOperations.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/IteratorOperations.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
</span><del>- * Copyright (C) 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -141,7 +141,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* createIteratorResultObjectStructure(VM& vm, JSGlobalObject& globalObject)
</span><span class="cx"> {
</span><del>- Structure* iteratorResultStructure = vm.prototypeMap.emptyObjectStructureForPrototype(globalObject.objectPrototype(), JSFinalObject::defaultInlineCapacity());
</del><ins>+ Structure* iteratorResultStructure = vm.prototypeMap.emptyObjectStructureForPrototype(&globalObject, globalObject.objectPrototype(), JSFinalObject::defaultInlineCapacity());
</ins><span class="cx"> PropertyOffset offset;
</span><span class="cx"> iteratorResultStructure = Structure::addPropertyTransition(vm, iteratorResultStructure, vm.propertyNames->done, 0, offset);
</span><span class="cx"> RELEASE_ASSERT(offset == donePropertyOffset);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -145,7 +145,7 @@
</span><span class="cx"> // currently. Whoever works on caching structure changes for prototype transistions should consider this problem as well.
</span><span class="cx"> // See: https://bugs.webkit.org/show_bug.cgi?id=152738
</span><span class="cx"> if (prototype.isObject() && prototype.getObject()->globalObject() == globalObject) {
</span><del>- result = vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype.getObject(), result);
</del><ins>+ result = vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(globalObject, prototype.getObject(), result);
</ins><span class="cx"> ASSERT_WITH_SECURITY_IMPLICATION(result->globalObject() == globalObject);
</span><span class="cx"> } else
</span><span class="cx"> result = Structure::create(vm, globalObject, prototype, result->typeInfo(), result->classInfo());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSFunction.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSFunction.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/JSFunction.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -134,10 +134,11 @@
</span><span class="cx"> ASSERT(!m_rareData);
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> JSObject* prototype = jsDynamicCast<JSObject*>(vm, get(exec, vm.propertyNames->prototype));
</span><ins>+ JSGlobalObject* globalObject = this->globalObject(vm);
</ins><span class="cx"> if (!prototype)
</span><del>- prototype = globalObject(vm)->objectPrototype();
</del><ins>+ prototype = globalObject->objectPrototype();
</ins><span class="cx"> FunctionRareData* rareData = FunctionRareData::create(vm);
</span><del>- rareData->initializeObjectAllocationProfile(vm, prototype, inlineCapacity);
</del><ins>+ rareData->initializeObjectAllocationProfile(vm, globalObject, prototype, inlineCapacity);
</ins><span class="cx">
</span><span class="cx"> // A DFG compilation thread may be trying to read the rare data
</span><span class="cx"> // We want to ensure that it sees it properly allocated
</span><span class="lines">@@ -152,9 +153,10 @@
</span><span class="cx"> ASSERT(!!m_rareData);
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> JSObject* prototype = jsDynamicCast<JSObject*>(vm, get(exec, vm.propertyNames->prototype));
</span><ins>+ JSGlobalObject* globalObject = this->globalObject(vm);
</ins><span class="cx"> if (!prototype)
</span><del>- prototype = globalObject(vm)->objectPrototype();
- m_rareData->initializeObjectAllocationProfile(vm, prototype, inlineCapacity);
</del><ins>+ prototype = globalObject->objectPrototype();
+ m_rareData->initializeObjectAllocationProfile(vm, globalObject, prototype, inlineCapacity);
</ins><span class="cx"> return m_rareData.get();
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007-2009, 2014-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007-2009, 2014-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008 Cameron Zwarich (cwzwarich@uwaterloo.ca)
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -457,7 +457,7 @@
</span><span class="cx"> protoAccessor->setSetter(vm, this, JSFunction::create(vm, this, 0, makeString("set ", vm.propertyNames->underscoreProto.string()), globalFuncProtoSetter));
</span><span class="cx"> m_objectPrototype->putDirectNonIndexAccessor(vm, vm.propertyNames->underscoreProto, protoAccessor, Accessor | DontEnum);
</span><span class="cx"> m_functionPrototype->structure()->setPrototypeWithoutTransition(vm, m_objectPrototype.get());
</span><del>- m_objectStructureForObjectConstructor.set(vm, this, vm.prototypeMap.emptyObjectStructureForPrototype(m_objectPrototype.get(), JSFinalObject::defaultInlineCapacity()));
</del><ins>+ m_objectStructureForObjectConstructor.set(vm, this, vm.prototypeMap.emptyObjectStructureForPrototype(this, m_objectPrototype.get(), JSFinalObject::defaultInlineCapacity()));
</ins><span class="cx">
</span><span class="cx"> JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeErrorArgumentsCalleeAndCaller);
</span><span class="cx"> GetterSetter* getterSetter = GetterSetter::create(vm, this);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSProxycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSProxy.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSProxy.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/JSProxy.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011-2012, 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -47,6 +47,8 @@
</span><span class="cx"> void JSProxy::setTarget(VM& vm, JSGlobalObject* globalObject)
</span><span class="cx"> {
</span><span class="cx"> ASSERT_ARG(globalObject, globalObject);
</span><ins>+ JSGlobalObject* previousGlobalObject = jsCast<JSGlobalObject*>(m_target.get());
+
</ins><span class="cx"> m_target.set(vm, this, globalObject);
</span><span class="cx"> setPrototypeDirect(vm, globalObject->getPrototypeDirect());
</span><span class="cx">
</span><span class="lines">@@ -54,11 +56,15 @@
</span><span class="cx"> if (!prototypeMap.isPrototype(this))
</span><span class="cx"> return;
</span><span class="cx">
</span><ins>+ // previousGlobalObject cannot be null because in order for this JSProxy to be used as a prototype
+ // of an object, we must have previously called setTarget() and associated it with a JSGlobalObject.
+ RELEASE_ASSERT(previousGlobalObject);
+
</ins><span class="cx"> // This is slow but constant time. We think it's very rare for a proxy
</span><span class="cx"> // to be a prototype, and reasonably rare to retarget a proxy,
</span><span class="cx"> // so slow constant time is OK.
</span><span class="cx"> for (size_t i = 0; i <= JSFinalObject::maxInlineCapacity(); ++i)
</span><del>- prototypeMap.clearEmptyObjectStructureForPrototype(this, i);
</del><ins>+ prototypeMap.clearEmptyObjectStructureForPrototype(previousGlobalObject, this, i);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> String JSProxy::className(const JSObject* object)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -71,8 +71,7 @@
</span><span class="cx"> {
</span><span class="cx"> JSGlobalObject* globalObject = exec->lexicalGlobalObject();
</span><span class="cx"> PrototypeMap& prototypeMap = globalObject->vm().prototypeMap;
</span><del>- Structure* structure = prototypeMap.emptyObjectStructureForPrototype(
- prototype, inlineCapacity);
</del><ins>+ Structure* structure = prototypeMap.emptyObjectStructureForPrototype(globalObject, prototype, inlineCapacity);
</ins><span class="cx"> return constructEmptyObject(exec, structure);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePrototypeMapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PrototypeMap.cpp (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PrototypeMap.cpp 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/PrototypeMap.cpp 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -54,9 +54,9 @@
</span><span class="cx"> // used as a prototype.
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline Structure* PrototypeMap::createEmptyStructure(JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
</del><ins>+inline Structure* PrototypeMap::createEmptyStructure(JSGlobalObject* globalObject, JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
</ins><span class="cx"> {
</span><del>- auto key = std::make_pair(prototype, std::make_pair(inlineCapacity, classInfo));
</del><ins>+ auto key = std::make_pair(prototype, std::make_pair(inlineCapacity, std::make_pair(classInfo, globalObject)));
</ins><span class="cx"> if (Structure* structure = m_structures.get(key)) {
</span><span class="cx"> ASSERT(isPrototype(prototype));
</span><span class="cx"> return structure;
</span><span class="lines">@@ -64,12 +64,12 @@
</span><span class="cx">
</span><span class="cx"> addPrototype(prototype);
</span><span class="cx"> Structure* structure = Structure::create(
</span><del>- prototype->globalObject()->vm(), prototype->globalObject(), prototype, typeInfo, classInfo, indexingType, inlineCapacity);
</del><ins>+ globalObject->vm(), globalObject, prototype, typeInfo, classInfo, indexingType, inlineCapacity);
</ins><span class="cx"> m_structures.set(key, Weak<Structure>(structure));
</span><span class="cx"> return structure;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-Structure* PrototypeMap::emptyStructureForPrototypeFromBaseStructure(JSObject* prototype, Structure* baseStructure)
</del><ins>+Structure* PrototypeMap::emptyStructureForPrototypeFromBaseStructure(JSGlobalObject* globalObject, JSObject* prototype, Structure* baseStructure)
</ins><span class="cx"> {
</span><span class="cx"> // We currently do not have inline capacity static analysis for subclasses and all internal function constructors have a default inline capacity of 0.
</span><span class="cx"> IndexingType indexingType = baseStructure->indexingType();
</span><span class="lines">@@ -76,17 +76,17 @@
</span><span class="cx"> if (prototype->structure()->anyObjectInChainMayInterceptIndexedAccesses() && hasIndexedProperties(indexingType))
</span><span class="cx"> indexingType = (indexingType & ~IndexingShapeMask) | SlowPutArrayStorageShape;
</span><span class="cx">
</span><del>- return createEmptyStructure(prototype, baseStructure->typeInfo(), baseStructure->classInfo(), indexingType, 0);
</del><ins>+ return createEmptyStructure(globalObject, prototype, baseStructure->typeInfo(), baseStructure->classInfo(), indexingType, 0);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-Structure* PrototypeMap::emptyObjectStructureForPrototype(JSObject* prototype, unsigned inlineCapacity)
</del><ins>+Structure* PrototypeMap::emptyObjectStructureForPrototype(JSGlobalObject* globalObject, JSObject* prototype, unsigned inlineCapacity)
</ins><span class="cx"> {
</span><del>- return createEmptyStructure(prototype, JSFinalObject::typeInfo(), JSFinalObject::info(), JSFinalObject::defaultIndexingType, inlineCapacity);
</del><ins>+ return createEmptyStructure(globalObject, prototype, JSFinalObject::typeInfo(), JSFinalObject::info(), JSFinalObject::defaultIndexingType, inlineCapacity);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-void PrototypeMap::clearEmptyObjectStructureForPrototype(JSObject* object, unsigned inlineCapacity)
</del><ins>+void PrototypeMap::clearEmptyObjectStructureForPrototype(JSGlobalObject* globalObject, JSObject* object, unsigned inlineCapacity)
</ins><span class="cx"> {
</span><del>- m_structures.remove(std::make_pair(object, std::make_pair(inlineCapacity, JSFinalObject::info())));
</del><ins>+ m_structures.remove(std::make_pair(object, std::make_pair(inlineCapacity, std::make_pair(JSFinalObject::info(), globalObject))));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePrototypeMaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PrototypeMap.h (212014 => 212015)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PrototypeMap.h 2017-02-10 01:33:43 UTC (rev 212014)
+++ trunk/Source/JavaScriptCore/runtime/PrototypeMap.h 2017-02-10 01:39:13 UTC (rev 212015)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -32,6 +32,7 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><ins>+class JSGlobalObject;
</ins><span class="cx"> class JSObject;
</span><span class="cx"> class Structure;
</span><span class="cx"> class VM;
</span><span class="lines">@@ -45,17 +46,18 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- JS_EXPORT_PRIVATE Structure* emptyObjectStructureForPrototype(JSObject*, unsigned inlineCapacity);
- JS_EXPORT_PRIVATE Structure* emptyStructureForPrototypeFromBaseStructure(JSObject*, Structure*);
- void clearEmptyObjectStructureForPrototype(JSObject*, unsigned inlineCapacity);
</del><ins>+ JS_EXPORT_PRIVATE Structure* emptyObjectStructureForPrototype(JSGlobalObject*, JSObject*, unsigned inlineCapacity);
+ JS_EXPORT_PRIVATE Structure* emptyStructureForPrototypeFromBaseStructure(JSGlobalObject*, JSObject*, Structure*);
+ void clearEmptyObjectStructureForPrototype(JSGlobalObject*, JSObject*, unsigned inlineCapacity);
</ins><span class="cx"> JS_EXPORT_PRIVATE void addPrototype(JSObject*);
</span><span class="cx"> inline TriState isPrototype(JSObject*) const; // Returns a conservative estimate.
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- Structure* createEmptyStructure(JSObject* prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
</del><ins>+ Structure* createEmptyStructure(JSGlobalObject*, JSObject* prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
</ins><span class="cx">
</span><span class="cx"> WeakGCMap<JSObject*, JSObject> m_prototypes;
</span><del>- typedef WeakGCMap<std::pair<JSObject*, std::pair<unsigned, const ClassInfo*>>, Structure> StructureMap;
</del><ins>+ // FIXME: make the key a struct.
+ typedef WeakGCMap<std::pair<JSObject*, std::pair<unsigned, std::pair<const ClassInfo*, JSGlobalObject*>>>, Structure> StructureMap;
</ins><span class="cx"> StructureMap m_structures;
</span><span class="cx"> };
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>