Skip to content

Commit b19a1ba

Browse files
isheludkoCommit Bot
isheludko
authored and
Commit Bot
committed
[ic] Fix storing to JSGlobalProxy having JSProxy in prototype chain.
Bug: chromium:764219 Change-Id: Ic68111e49da508aba255b1c651a85b2b00e62947 Reviewed-on: https://chromium-review.googlesource.com/718108 Reviewed-by: Toon Verwaest <[email protected]> Commit-Queue: Igor Sheludko <[email protected]> Cr-Commit-Position: refs/heads/master@{#48534}
1 parent caead4d commit b19a1ba

File tree

6 files changed

+59
-38
lines changed

6 files changed

+59
-38
lines changed

‎src/ic/accessor-assembler.cc‎

Lines changed: 39 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -758,7 +758,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
758758

759759
// IC dispatchers rely on these assumptions to be held.
760760
STATIC_ASSERT(FixedArray::kLengthOffset ==
761-
StoreHandler::kTransitionCellOffset);
761+
StoreHandler::kTransitionOrHolderCellOffset);
762762
DCHECK_EQ(FixedArray::OffsetOfElementAt(StoreHandler::kSmiHandlerIndex),
763763
StoreHandler::kSmiHandlerOffset);
764764
DCHECK_EQ(FixedArray::OffsetOfElementAt(StoreHandler::kValidityCellIndex),
@@ -779,18 +779,16 @@ void AccessorAssembler::HandleStoreICProtoHandler(
779779
Node* smi_or_code = LoadObjectField(handler, StoreHandler::kSmiHandlerOffset);
780780

781781
Node* maybe_transition_cell =
782-
LoadObjectField(handler, StoreHandler::kTransitionCellOffset);
782+
LoadObjectField(handler, StoreHandler::kTransitionOrHolderCellOffset);
783783
Label array_handler(this), tuple_handler(this);
784784
Branch(TaggedIsSmi(maybe_transition_cell), &array_handler, &tuple_handler);
785785

786-
VARIABLE(var_transition, MachineRepresentation::kTagged);
787-
Label if_transition(this), if_transition_to_constant(this),
788-
if_store_normal(this), if_store_global_proxy(this), if_proxy(this),
789-
do_store(this);
786+
VARIABLE(var_transition_map_or_holder, MachineRepresentation::kTagged);
787+
Label do_store(this), if_transition_map(this), if_holder_object(this);
790788
BIND(&tuple_handler);
791789
{
792790
Node* transition = LoadWeakCellValue(maybe_transition_cell, miss);
793-
var_transition.Bind(transition);
791+
var_transition_map_or_holder.Bind(transition);
794792
Goto(&do_store);
795793
}
796794

@@ -831,32 +829,27 @@ void AccessorAssembler::HandleStoreICProtoHandler(
831829
},
832830
1, INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
833831

834-
Node* maybe_transition_cell =
835-
LoadFixedArrayElement(handler, StoreHandler::kTransitionCellIndex);
832+
Node* maybe_transition_cell = LoadFixedArrayElement(
833+
handler, StoreHandler::kTransitionMapOrHolderCellIndex);
836834
Node* transition = LoadWeakCellValue(maybe_transition_cell, miss);
837-
var_transition.Bind(transition);
835+
var_transition_map_or_holder.Bind(transition);
838836
Goto(&do_store);
839837
}
840838

841839
BIND(&do_store);
842840
{
843-
Branch(SmiEqual(smi_or_code, SmiConstant(StoreHandler::kProxy)), &if_proxy,
844-
&if_transition);
841+
Node* transition = var_transition_map_or_holder.value();
842+
Branch(IsMap(transition), &if_transition_map, &if_holder_object);
845843
}
846844

847-
BIND(&if_proxy);
845+
BIND(&if_transition_map);
848846
{
849-
Node* proxy = var_transition.value();
850-
HandleStoreToProxy(p, proxy, miss, support_elements);
851-
}
847+
Label if_transition_to_constant(this), if_store_normal(this);
852848

853-
BIND(&if_transition);
854-
{
855849
Node* holder = p->receiver;
856-
Node* transition = var_transition.value();
850+
Node* transition_map = var_transition_map_or_holder.value();
857851

858-
GotoIfNot(IsMap(transition), &if_store_global_proxy);
859-
GotoIf(IsDeprecatedMap(transition), miss);
852+
GotoIf(IsDeprecatedMap(transition_map), miss);
860853

861854
if (support_elements == kSupportElements) {
862855
Label if_smi_handler(this);
@@ -867,7 +860,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
867860

868861
StoreTransitionDescriptor descriptor(isolate());
869862
TailCallStub(descriptor, code_handler, p->context, p->receiver, p->name,
870-
transition, p->value, p->slot, p->vector);
863+
transition_map, p->value, p->slot, p->vector);
871864

872865
BIND(&if_smi_handler);
873866
}
@@ -882,13 +875,12 @@ void AccessorAssembler::HandleStoreICProtoHandler(
882875
GotoIf(WordEqual(handler_kind,
883876
IntPtrConstant(StoreHandler::kTransitionToConstant)),
884877
&if_transition_to_constant);
885-
// This case is already handled above.
886878
CSA_ASSERT(this,
887-
WordNotEqual(handler_kind,
888-
IntPtrConstant(StoreHandler::kStoreGlobalProxy)));
879+
WordEqual(handler_kind,
880+
IntPtrConstant(StoreHandler::kTransitionToField)));
889881

890882
// Handle transitioning field stores.
891-
HandleStoreICSmiHandlerCase(handler_word, holder, p->value, transition,
883+
HandleStoreICSmiHandlerCase(handler_word, holder, p->value, transition_map,
892884
miss);
893885

894886
BIND(&if_transition_to_constant);
@@ -901,15 +893,15 @@ void AccessorAssembler::HandleStoreICProtoHandler(
901893
IntPtrAdd(scaled_descriptor,
902894
IntPtrConstant(DescriptorArray::kFirstIndex +
903895
DescriptorArray::kEntryValueIndex));
904-
Node* descriptors = LoadMapDescriptors(transition);
896+
Node* descriptors = LoadMapDescriptors(transition_map);
905897
CSA_ASSERT(
906898
this, UintPtrLessThan(descriptor,
907899
LoadAndUntagFixedArrayBaseLength(descriptors)));
908900

909901
Node* constant = LoadFixedArrayElement(descriptors, value_index);
910902
GotoIf(WordNotEqual(p->value, constant), miss);
911903

912-
StoreMap(p->receiver, transition);
904+
StoreMap(p->receiver, transition_map);
913905
Return(p->value);
914906
}
915907

@@ -948,10 +940,28 @@ void AccessorAssembler::HandleStoreICProtoHandler(
948940
p->receiver, p->name, p->value);
949941
}
950942
}
943+
}
944+
BIND(&if_holder_object);
945+
{
946+
Label if_store_global_proxy(this);
947+
Node* holder = var_transition_map_or_holder.value();
948+
949+
Node* smi_handler = smi_or_code;
950+
CSA_ASSERT(this, TaggedIsSmi(smi_handler));
951+
Node* handler_word = SmiUntag(smi_handler);
952+
953+
Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
954+
GotoIf(WordEqual(handler_kind,
955+
IntPtrConstant(StoreHandler::kStoreGlobalProxy)),
956+
&if_store_global_proxy);
957+
CSA_ASSERT(this,
958+
WordEqual(handler_kind, IntPtrConstant(StoreHandler::kProxy)));
959+
HandleStoreToProxy(p, holder, miss, support_elements);
960+
951961
BIND(&if_store_global_proxy);
952962
{
953963
ExitPoint direct_exit(this);
954-
StoreGlobalIC_PropertyCellCase(transition, p->value, &direct_exit, miss);
964+
StoreGlobalIC_PropertyCellCase(holder, p->value, &direct_exit, miss);
955965
}
956966
}
957967
}

‎src/ic/handler-configuration-inl.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -196,15 +196,15 @@ Handle<Smi> StoreHandler::TransitionToConstant(Isolate* isolate,
196196
// static
197197
WeakCell* StoreHandler::GetTransitionCell(Object* handler) {
198198
if (handler->IsTuple3()) {
199-
STATIC_ASSERT(kTransitionCellOffset == Tuple3::kValue1Offset);
199+
STATIC_ASSERT(kTransitionOrHolderCellOffset == Tuple3::kValue1Offset);
200200
WeakCell* cell = WeakCell::cast(Tuple3::cast(handler)->value1());
201201
DCHECK(!cell->cleared());
202202
return cell;
203203
}
204204

205205
DCHECK(handler->IsFixedArray());
206-
WeakCell* cell =
207-
WeakCell::cast(FixedArray::cast(handler)->get(kTransitionCellIndex));
206+
WeakCell* cell = WeakCell::cast(
207+
FixedArray::cast(handler)->get(kTransitionMapOrHolderCellIndex));
208208
DCHECK(!cell->cleared());
209209
return cell;
210210
}

‎src/ic/handler-configuration.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -314,7 +314,7 @@ Handle<Object> StoreHandler::StoreTransition(Isolate* isolate,
314314
factory->NewFixedArray(kFirstPrototypeIndex + checks_count, TENURED));
315315
handler_array->set(kSmiHandlerIndex, *smi_handler);
316316
handler_array->set(kValidityCellIndex, *validity_cell);
317-
handler_array->set(kTransitionCellIndex, *transition_cell);
317+
handler_array->set(kTransitionMapOrHolderCellIndex, *transition_cell);
318318
InitPrototypeChecks(isolate, receiver_map, holder, name, handler_array,
319319
kFirstPrototypeIndex);
320320
return handler_array;
@@ -363,7 +363,7 @@ Handle<Object> StoreHandler::StoreProxy(Isolate* isolate,
363363
factory->NewFixedArray(kFirstPrototypeIndex + checks_count, TENURED));
364364
handler_array->set(kSmiHandlerIndex, *smi_handler);
365365
handler_array->set(kValidityCellIndex, *validity_cell);
366-
handler_array->set(kTransitionCellIndex, *holder_cell);
366+
handler_array->set(kTransitionMapOrHolderCellIndex, *holder_cell);
367367
InitPrototypeChecks(isolate, receiver_map, proxy, name, handler_array,
368368
kFirstPrototypeIndex);
369369
return handler_array;

‎src/ic/handler-configuration.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ class StoreHandler {
229229
// The layout of an Tuple3 handler representing a transitioning store
230230
// when prototype chain checks do not include non-existing lookups or access
231231
// checks.
232-
static const int kTransitionCellOffset = Tuple3::kValue1Offset;
232+
static const int kTransitionOrHolderCellOffset = Tuple3::kValue1Offset;
233233
static const int kSmiHandlerOffset = Tuple3::kValue2Offset;
234234
static const int kValidityCellOffset = Tuple3::kValue3Offset;
235235

@@ -241,7 +241,7 @@ class StoreHandler {
241241
// when prototype chain checks include non-existing lookups and access checks.
242242
static const int kSmiHandlerIndex = 0;
243243
static const int kValidityCellIndex = 1;
244-
static const int kTransitionCellIndex = 2;
244+
static const int kTransitionMapOrHolderCellIndex = 2;
245245
static const int kFirstPrototypeIndex = 3;
246246

247247
// Creates a Smi-handler for storing a field to fast object.

‎src/ic/keyed-store-generic.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -811,14 +811,14 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
811811
BIND(&tuple3);
812812
{
813813
var_transition_cell.Bind(LoadObjectField(
814-
maybe_handler, StoreHandler::kTransitionCellOffset));
814+
maybe_handler, StoreHandler::kTransitionOrHolderCellOffset));
815815
Goto(&check_key);
816816
}
817817

818818
BIND(&fixedarray);
819819
{
820820
var_transition_cell.Bind(LoadFixedArrayElement(
821-
maybe_handler, StoreHandler::kTransitionCellIndex));
821+
maybe_handler, StoreHandler::kTransitionMapOrHolderCellIndex));
822822
Goto(&check_key);
823823
}
824824

‎test/mjsunit/regress/regress-crbug-764219.js‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,14 @@
2222
f(this);
2323
f(this);
2424
})();
25+
26+
(function() {
27+
function f(o) {
28+
o.z = 153;
29+
};
30+
31+
Object.setPrototypeOf(this, new Proxy({get z(){}}, {}));
32+
f({});
33+
f(this);
34+
f(this);
35+
})();

0 commit comments

Comments
 (0)