Attachment 372860 Details for Bug 199202 – Patch

[patch] Patch

bug-199202-20190625135754.patch (text/plain), 5.15 KB, created by Keith Miller on 2019-06-25 13:57:54 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2019-06-25 13:57:54 PDT

Size: 5.15 KB

patch

obsolete

>Subversion Revision: 246806
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index fc5ff084d4c47f675f1fc052e2605fea55b25e14..8cc4ca32cede637ea330afe2ff1dd625e876b2cf 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,20 @@
>+2019-06-25  Keith Miller  <keith_miller@apple.com>
>+
>+        Add didBecomePrototype() calls to global context prototypes
>+        https://bugs.webkit.org/show_bug.cgi?id=199202
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This fixes some crashes related to checking that all prototypes have been
>+        marked as such to JSC.
>+
>+        * bindings/js/JSWindowProxy.cpp:
>+        (WebCore::JSWindowProxy::setWindow):
>+        * bindings/js/WorkerScriptController.cpp:
>+        (WebCore::WorkerScriptController::initScript):
>+        * worklets/WorkletScriptController.cpp:
>+        (WebCore::WorkletScriptController::initScriptWithSubclass):
>+
> 2019-06-25  Joseph Pecoraro  <pecoraro@apple.com>
> 
>         Web Inspector: Implement console.timeLog
>diff --git a/Source/WebCore/bindings/js/JSWindowProxy.cpp b/Source/WebCore/bindings/js/JSWindowProxy.cpp
>index bf0e22591e546d0d81f63e48d66707fbacd61d63..c229749860b5a5240ac55c884a024dba9d6629e2 100644
>--- a/Source/WebCore/bindings/js/JSWindowProxy.cpp
>+++ b/Source/WebCore/bindings/js/JSWindowProxy.cpp
>@@ -111,6 +111,7 @@ void JSWindowProxy::setWindow(AbstractDOMWindow& domWindow)
> 
>     auto& propertiesStructure = *JSDOMWindowProperties::createStructure(vm, window, JSEventTarget::prototype(vm, *window));
>     auto& properties = *JSDOMWindowProperties::create(&propertiesStructure, *window);
>+    properties.didBecomePrototype();
>     prototype->structure(vm)->setPrototypeWithoutTransition(vm, &properties);
> 
>     setWindow(vm, *window);
>diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
>index a623523d0d7a96a89281d8c77da6686dc14ef44d..6f75d16159b70e6528182231ba55d42256cbbab1 100644
>--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
>+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
>@@ -90,7 +90,9 @@ void WorkerScriptController::initScript()
>         ASSERT(structure->globalObject() == m_workerGlobalScopeWrapper);
>         ASSERT(m_workerGlobalScopeWrapper->structure(*m_vm)->globalObject() == m_workerGlobalScopeWrapper);
>         dedicatedContextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
>-        dedicatedContextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get()));
>+        auto* workerGlobalScopePrototype = JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get());
>+        workerGlobalScopePrototype->didBecomePrototype();
>+        dedicatedContextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, workerGlobalScopePrototype);
> 
>         proxy->setTarget(*m_vm, m_workerGlobalScopeWrapper.get());
>         proxy->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
>@@ -107,7 +109,9 @@ void WorkerScriptController::initScript()
>         ASSERT(structure->globalObject() == m_workerGlobalScopeWrapper);
>         ASSERT(m_workerGlobalScopeWrapper->structure()->globalObject() == m_workerGlobalScopeWrapper);
>         contextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
>-        contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get()));
>+        auto* workerGlobalScopePrototype = JSWorkerGlobalScope::prototype(*m_vm, *m_workerGlobalScopeWrapper.get());
>+        workerGlobalScopePrototype->didBecomePrototype();
>+        contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, workerGlobalScopePrototype);
> 
>         proxy->setTarget(*m_vm, m_workerGlobalScopeWrapper.get());
>         proxy->structure(*m_vm)->setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
>diff --git a/Source/WebCore/worklets/WorkletScriptController.cpp b/Source/WebCore/worklets/WorkletScriptController.cpp
>index 1168978e424df1c48e461c5889c78fcdba067b6f..1cee9eb3421cd99a56c8860b8ecdd4596f80d2de 100644
>--- a/Source/WebCore/worklets/WorkletScriptController.cpp
>+++ b/Source/WebCore/worklets/WorkletScriptController.cpp
>@@ -126,7 +126,9 @@ void WorkletScriptController::initScriptWithSubclass()
>     ASSERT(structure->globalObject() == m_workletGlobalScopeWrapper);
>     ASSERT(m_workletGlobalScopeWrapper->structure(*m_vm)->globalObject() == m_workletGlobalScopeWrapper);
>     contextPrototype->structure(*m_vm)->setGlobalObject(*m_vm, m_workletGlobalScopeWrapper.get());
>-    contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, JSGlobalScope::prototype(*m_vm, *m_workletGlobalScopeWrapper.get()));
>+    auto* globalScopePrototype = JSGlobalScope::prototype(*m_vm, *m_workletGlobalScopeWrapper.get());
>+    globalScopePrototype->didBecomePrototype();
>+    contextPrototype->structure(*m_vm)->setPrototypeWithoutTransition(*m_vm, globalScopePrototype);
> 
>     proxy->setTarget(*m_vm, m_workletGlobalScopeWrapper.get());
>     proxy->structure(*m_vm)->setGlobalObject(*m_vm, m_workletGlobalScopeWrapper.get());

Actions: View | Formatted Diff | Diff

Attachments on bug 199202: 372860 | 372862