Bug 198477 – [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Yusuke Suzuki]

...

[Yusuke Suzuki]

Created attachment 371184 [details]
Patch

[Yusuke Suzuki]

<rdar://problem/51299504>

[Saam Barati]

Comment on attachment 371184 [details]
Patch

Why? Won't this lead to use calling getPrototypeOf twice on proxy?

[Yusuke Suzuki]

Comment on attachment 371184 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=371184&action=review

Otherwise, as the test described (without this patch, it fails), object[10101010] = xxx; bypasses getPrototype (instead using getPrototypeDirect), which means that this [[Put]] access bypasses JSWindow::getPrototype.

attemptToInterceptPutByIndexOnHoleForPrototype is not a side-effect free check. If put is intercepted, this function performs [[Put]].

> Source/JavaScriptCore/runtime/JSObject.cpp:2747
>          if (current->type() == ProxyObjectType) {
> +            scope.release();
>              ProxyObject* proxy = jsCast<ProxyObject*>(current);
>              putResult = proxy->putByIndexCommon(exec, thisValue, i, value, shouldThrow);
>              return true;

For example, Proxy case goes into this path, and we actually performs [[Put]] here.

[Yusuke Suzuki]

Comment on attachment 371184 [details]
Patch

Thanks

[WebKit Commit Bot]

Comment on attachment 371184 [details]
Patch

Clearing flags on attachment: 371184

Committed r246040: <https://trac.webkit.org/changeset/246040>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Yusuke Suzuki]

Committed r246084: <https://trac.webkit.org/changeset/246084>