Title: [245031] trunk
- Revision
- 245031
- Author
- rmoris...@apple.com
- Date
- 2019-05-07 13:59:44 -0700 (Tue, 07 May 2019)
Log Message
All prototypes should call didBecomePrototype()
https://bugs.webkit.org/show_bug.cgi?id=196315
Reviewed by Saam Barati.
JSTests:
* stress/function-prototype-indexed-accessor.js: Added.
Source/_javascript_Core:
Otherwise we won't remember to run haveABadTime() when someone adds to them an indexed accessor.
I added a check used in both Structure::finishCreation() and Structure::changePrototypeTransition to make sure we don't
create structures with invalid prototypes.
It found a lot of objects that are used as prototypes in JSGlobalObject and yet were missing didBecomePrototype() in their finishCreation().
Somewhat surprisingly, some of them have names like FunctionConstructor and not only FooPrototype.
* runtime/BigIntPrototype.cpp:
(JSC::BigIntPrototype::finishCreation):
* runtime/BooleanPrototype.cpp:
(JSC::BooleanPrototype::finishCreation):
* runtime/DatePrototype.cpp:
(JSC::DatePrototype::finishCreation):
* runtime/ErrorConstructor.cpp:
(JSC::ErrorConstructor::finishCreation):
* runtime/ErrorPrototype.cpp:
(JSC::ErrorPrototype::finishCreation):
* runtime/FunctionConstructor.cpp:
(JSC::FunctionConstructor::finishCreation):
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::finishCreation):
* runtime/IntlCollatorPrototype.cpp:
(JSC::IntlCollatorPrototype::finishCreation):
* runtime/IntlDateTimeFormatPrototype.cpp:
(JSC::IntlDateTimeFormatPrototype::finishCreation):
* runtime/IntlNumberFormatPrototype.cpp:
(JSC::IntlNumberFormatPrototype::finishCreation):
* runtime/IntlPluralRulesPrototype.cpp:
(JSC::IntlPluralRulesPrototype::finishCreation):
* runtime/JSArrayBufferPrototype.cpp:
(JSC::JSArrayBufferPrototype::finishCreation):
* runtime/JSDataViewPrototype.cpp:
(JSC::JSDataViewPrototype::finishCreation):
* runtime/JSGenericTypedArrayViewPrototypeInlines.h:
(JSC::JSGenericTypedArrayViewPrototype<ViewClass>::finishCreation):
* runtime/JSGlobalObject.cpp:
(JSC::createConsoleProperty):
* runtime/JSPromisePrototype.cpp:
(JSC::JSPromisePrototype::finishCreation):
* runtime/JSTypedArrayViewConstructor.cpp:
(JSC::JSTypedArrayViewConstructor::finishCreation):
* runtime/JSTypedArrayViewPrototype.cpp:
(JSC::JSTypedArrayViewPrototype::finishCreation):
* runtime/NumberPrototype.cpp:
(JSC::NumberPrototype::finishCreation):
* runtime/RegExpPrototype.cpp:
(JSC::RegExpPrototype::finishCreation):
* runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
* runtime/Structure.cpp:
(JSC::Structure::isValidPrototype):
(JSC::Structure::changePrototypeTransition):
* runtime/Structure.h:
* runtime/SymbolPrototype.cpp:
(JSC::SymbolPrototype::finishCreation):
* wasm/js/WebAssemblyCompileErrorPrototype.cpp:
(JSC::WebAssemblyCompileErrorPrototype::finishCreation):
* wasm/js/WebAssemblyInstancePrototype.cpp:
(JSC::WebAssemblyInstancePrototype::finishCreation):
* wasm/js/WebAssemblyLinkErrorPrototype.cpp:
(JSC::WebAssemblyLinkErrorPrototype::finishCreation):
* wasm/js/WebAssemblyMemoryPrototype.cpp:
(JSC::WebAssemblyMemoryPrototype::finishCreation):
* wasm/js/WebAssemblyModulePrototype.cpp:
(JSC::WebAssemblyModulePrototype::finishCreation):
* wasm/js/WebAssemblyPrototype.cpp:
(JSC::WebAssemblyPrototype::finishCreation):
* wasm/js/WebAssemblyRuntimeErrorPrototype.cpp:
(JSC::WebAssemblyRuntimeErrorPrototype::finishCreation):
* wasm/js/WebAssemblyTablePrototype.cpp:
(JSC::WebAssemblyTablePrototype::finishCreation):
Source/WebCore:
It was found by existing tests, with the new assert in JSC::Structure
* bindings/js/JSWindowProxy.cpp:
(WebCore::JSWindowProxy::setWindow):
* bindings/scripts/CodeGeneratorJS.pm:
(GeneratePrototypeDeclaration):
(GenerateConstructorHelperMethods):
Modified Paths
Diff
Modified: trunk/JSTests/ChangeLog (245030 => 245031)
--- trunk/JSTests/ChangeLog 2019-05-07 20:46:43 UTC (rev 245030)
+++ trunk/JSTests/ChangeLog 2019-05-07 20:59:44 UTC (rev 245031)
@@ -1,3 +1,12 @@
+2019-05-07 Robin Morisset <rmoris...@apple.com>
+
+ All prototypes should call didBecomePrototype()
+ https://bugs.webkit.org/show_bug.cgi?id=196315
+
+ Reviewed by Saam Barati.
+
+ * stress/function-prototype-indexed-accessor.js: Added.
+
2019-05-07 Commit Queue <commit-qu...@webkit.org>
Unreviewed, rolling out r244978.
Modified: trunk/Source/_javascript_Core/ChangeLog (245030 => 245031)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-07 20:46:43 UTC (rev 245030)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-07 20:59:44 UTC (rev 245031)
@@ -1,5 +1,84 @@
2019-05-07 Robin Morisset <rmoris...@apple.com>
+ All prototypes should call didBecomePrototype()
+ https://bugs.webkit.org/show_bug.cgi?id=196315
+
+ Reviewed by Saam Barati.
+
+ Otherwise we won't remember to run haveABadTime() when someone adds to them an indexed accessor.
+
+ I added a check used in both Structure::finishCreation() and Structure::changePrototypeTransition to make sure we don't
+ create structures with invalid prototypes.
+ It found a lot of objects that are used as prototypes in JSGlobalObject and yet were missing didBecomePrototype() in their finishCreation().
+ Somewhat surprisingly, some of them have names like FunctionConstructor and not only FooPrototype.
+
+ * runtime/BigIntPrototype.cpp:
+ (JSC::BigIntPrototype::finishCreation):
+ * runtime/BooleanPrototype.cpp:
+ (JSC::BooleanPrototype::finishCreation):
+ * runtime/DatePrototype.cpp:
+ (JSC::DatePrototype::finishCreation):
+ * runtime/ErrorConstructor.cpp:
+ (JSC::ErrorConstructor::finishCreation):
+ * runtime/ErrorPrototype.cpp:
+ (JSC::ErrorPrototype::finishCreation):
+ * runtime/FunctionConstructor.cpp:
+ (JSC::FunctionConstructor::finishCreation):
+ * runtime/FunctionPrototype.cpp:
+ (JSC::FunctionPrototype::finishCreation):
+ * runtime/IntlCollatorPrototype.cpp:
+ (JSC::IntlCollatorPrototype::finishCreation):
+ * runtime/IntlDateTimeFormatPrototype.cpp:
+ (JSC::IntlDateTimeFormatPrototype::finishCreation):
+ * runtime/IntlNumberFormatPrototype.cpp:
+ (JSC::IntlNumberFormatPrototype::finishCreation):
+ * runtime/IntlPluralRulesPrototype.cpp:
+ (JSC::IntlPluralRulesPrototype::finishCreation):
+ * runtime/JSArrayBufferPrototype.cpp:
+ (JSC::JSArrayBufferPrototype::finishCreation):
+ * runtime/JSDataViewPrototype.cpp:
+ (JSC::JSDataViewPrototype::finishCreation):
+ * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+ (JSC::JSGenericTypedArrayViewPrototype<ViewClass>::finishCreation):
+ * runtime/JSGlobalObject.cpp:
+ (JSC::createConsoleProperty):
+ * runtime/JSPromisePrototype.cpp:
+ (JSC::JSPromisePrototype::finishCreation):
+ * runtime/JSTypedArrayViewConstructor.cpp:
+ (JSC::JSTypedArrayViewConstructor::finishCreation):
+ * runtime/JSTypedArrayViewPrototype.cpp:
+ (JSC::JSTypedArrayViewPrototype::finishCreation):
+ * runtime/NumberPrototype.cpp:
+ (JSC::NumberPrototype::finishCreation):
+ * runtime/RegExpPrototype.cpp:
+ (JSC::RegExpPrototype::finishCreation):
+ * runtime/StringPrototype.cpp:
+ (JSC::StringPrototype::finishCreation):
+ * runtime/Structure.cpp:
+ (JSC::Structure::isValidPrototype):
+ (JSC::Structure::changePrototypeTransition):
+ * runtime/Structure.h:
+ * runtime/SymbolPrototype.cpp:
+ (JSC::SymbolPrototype::finishCreation):
+ * wasm/js/WebAssemblyCompileErrorPrototype.cpp:
+ (JSC::WebAssemblyCompileErrorPrototype::finishCreation):
+ * wasm/js/WebAssemblyInstancePrototype.cpp:
+ (JSC::WebAssemblyInstancePrototype::finishCreation):
+ * wasm/js/WebAssemblyLinkErrorPrototype.cpp:
+ (JSC::WebAssemblyLinkErrorPrototype::finishCreation):
+ * wasm/js/WebAssemblyMemoryPrototype.cpp:
+ (JSC::WebAssemblyMemoryPrototype::finishCreation):
+ * wasm/js/WebAssemblyModulePrototype.cpp:
+ (JSC::WebAssemblyModulePrototype::finishCreation):
+ * wasm/js/WebAssemblyPrototype.cpp:
+ (JSC::WebAssemblyPrototype::finishCreation):
+ * wasm/js/WebAssemblyRuntimeErrorPrototype.cpp:
+ (JSC::WebAssemblyRuntimeErrorPrototype::finishCreation):
+ * wasm/js/WebAssemblyTablePrototype.cpp:
+ (JSC::WebAssemblyTablePrototype::finishCreation):
+
+2019-05-07 Robin Morisset <rmoris...@apple.com>
+
WTF::BitVector should have an isEmpty() method
https://bugs.webkit.org/show_bug.cgi?id=197637
Modified: trunk/Source/WebCore/ChangeLog (245030 => 245031)
--- trunk/Source/WebCore/ChangeLog 2019-05-07 20:46:43 UTC (rev 245030)
+++ trunk/Source/WebCore/ChangeLog 2019-05-07 20:59:44 UTC (rev 245031)
@@ -1,3 +1,18 @@
+2019-05-07 Robin Morisset <rmoris...@apple.com>
+
+ All prototypes should call didBecomePrototype()
+ https://bugs.webkit.org/show_bug.cgi?id=196315
+
+ Reviewed by Saam Barati.
+
+ It was found by existing tests, with the new assert in JSC::Structure
+
+ * bindings/js/JSWindowProxy.cpp:
+ (WebCore::JSWindowProxy::setWindow):
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (GeneratePrototypeDeclaration):
+ (GenerateConstructorHelperMethods):
+
2019-05-07 John Wilander <wilan...@apple.com>
Storage Access API: Make two changes requested by developers and complete refactoring and cleanup
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
