From f3af6fe8ebc4b074d40d387518f7ea993f5c5554 Mon Sep 17 00:00:00 2001 From: Keith Miller Date: Tue, 21 May 2024 21:17:52 -0700 Subject: [PATCH] presenceConditionIfConsistent should check knownBase's structure is in the structure set https://bugs.webkit.org/show_bug.cgi?id=269220 rdar://122171551 Reviewed by Yusuke Suzuki. This patch rewrites ByteCodeParser::presenceConditionIfConsistent. Now it just checks that the presence condition we're trying to create is possible for the knownBase. Additionally, we have to check that the knownBase's structure was executed at least once before. This allows us to know if GetOwnPropertySlot ran successfully at least once for this structure. * Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::presenceConditionIfConsistent): Originally-landed-as: 272448.563@safari-7618-branch (630351ee51ab). rdar://128502736 Canonical link: https://commits.webkit.org/279106@main --- .../JavaScriptCore/dfg/DFGByteCodeParser.cpp | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp index 26b0f9f643186..e99f10f6d1a87 100644 --- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp +++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp @@ -4486,18 +4486,18 @@ Node* ByteCodeParser::load( ObjectPropertyCondition ByteCodeParser::presenceConditionIfConsistent(JSObject* knownBase, UniquedStringImpl* uid, PropertyOffset offset, const StructureSet& set) { - if (set.isEmpty()) - return ObjectPropertyCondition(); + Structure* structure = knownBase->structure(); unsigned attributes; - PropertyOffset firstOffset = set[0]->getConcurrently(uid, attributes); - if (firstOffset != offset) + PropertyOffset baseOffset = structure->getConcurrently(uid, attributes); + if (offset != baseOffset) return ObjectPropertyCondition(); - for (unsigned i = 1; i < set.size(); ++i) { - unsigned otherAttributes; - PropertyOffset otherOffset = set[i]->getConcurrently(uid, otherAttributes); - if (otherOffset != offset || otherAttributes != attributes) - return ObjectPropertyCondition(); - } + + // We need to check set contains knownBase's structure because knownBase's GetOwnPropertySlot could normally prevent access + // to this property, for example via a cross-origin restriction check. So unless we've executed this access before we can't assume + // just because knownBase has a property uid at offset we're allowed to access. + if (!set.contains(structure)) + return ObjectPropertyCondition(); + return ObjectPropertyCondition::presenceWithoutBarrier(knownBase, uid, offset, attributes); }