Skip to content

Commit 1088273

Browse files
rerobikadbatyai
rerobika
authored and
dbatyai
committed
Prevent fast access mode arrays from low-level property management methods (#3047)
This patch fixes #3043 and fixes #3045 and fixes #3046. JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik [email protected]
1 parent 3e661c0 commit 1088273

12 files changed

+141
-21
lines changed

‎jerry-core/ecma/base/ecma-helpers-external-pointers.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
*/
1515

1616
#include "ecma-alloc.h"
17+
#include "ecma-array-object.h"
1718
#include "ecma-globals.h"
1819
#include "ecma-objects.h"
1920
#include "ecma-helpers.h"
@@ -37,6 +38,13 @@ ecma_create_native_pointer_property (ecma_object_t *obj_p, /**< object to create
3738
void *info_p) /**< native pointer's type info */
3839
{
3940
ecma_string_t *name_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_NATIVE_POINTER);
41+
42+
if (ecma_get_object_type (obj_p) == ECMA_OBJECT_TYPE_ARRAY
43+
&& ((ecma_extended_object_t *) obj_p)->u.array.is_fast_mode)
44+
{
45+
ecma_fast_array_convert_to_normal (obj_p);
46+
}
47+
4048
ecma_property_t *property_p = ecma_find_named_property (obj_p, name_p);
4149

4250
bool is_new = (property_p == NULL);
@@ -107,6 +115,13 @@ ecma_native_pointer_t *
107115
ecma_get_native_pointer_value (ecma_object_t *obj_p, /**< object to get property value from */
108116
void *info_p) /**< native pointer's type info */
109117
{
118+
if (ecma_get_object_type (obj_p) == ECMA_OBJECT_TYPE_ARRAY
119+
&& ((ecma_extended_object_t *) obj_p)->u.array.is_fast_mode)
120+
{
121+
/* Fast access mode array can not have native pointer properties */
122+
return NULL;
123+
}
124+
110125
ecma_string_t *name_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_NATIVE_POINTER);
111126
ecma_property_t *property_p = ecma_find_named_property (obj_p, name_p);
112127

@@ -149,6 +164,13 @@ bool
149164
ecma_delete_native_pointer_property (ecma_object_t *obj_p, /**< object to delete property from */
150165
void *info_p) /**< native pointer's type info */
151166
{
167+
if (ecma_get_object_type (obj_p) == ECMA_OBJECT_TYPE_ARRAY
168+
&& ((ecma_extended_object_t *) obj_p)->u.array.is_fast_mode)
169+
{
170+
/* Fast access mode array can not have native pointer properties */
171+
return false;
172+
}
173+
152174
ecma_string_t *name_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_NATIVE_POINTER);
153175
ecma_property_t *property_p = ecma_find_named_property (obj_p, name_p);
154176

‎jerry-core/ecma/base/ecma-helpers.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -335,9 +335,6 @@ ecma_create_property (ecma_object_t *object_p, /**< the object */
335335
JERRY_ASSERT (ECMA_PROPERTY_PAIR_ITEM_COUNT == 2);
336336
JERRY_ASSERT (name_p != NULL);
337337
JERRY_ASSERT (object_p != NULL);
338-
JERRY_ASSERT (ecma_is_lexical_environment (object_p)
339-
|| ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
340-
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
341338

342339
jmem_cpointer_t *property_list_head_p = &object_p->u1.property_list_cp;
343340

@@ -475,6 +472,9 @@ ecma_create_named_data_property (ecma_object_t *object_p, /**< object */
475472
* if this field is non-NULL */
476473
{
477474
JERRY_ASSERT (object_p != NULL && name_p != NULL);
475+
JERRY_ASSERT (ecma_is_lexical_environment (object_p)
476+
|| ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
477+
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
478478
JERRY_ASSERT (ecma_find_named_property (object_p, name_p) == NULL);
479479
JERRY_ASSERT ((prop_attributes & ~ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE) == 0);
480480

@@ -501,6 +501,9 @@ ecma_create_named_accessor_property (ecma_object_t *object_p, /**< object */
501501
* if this field is non-NULL */
502502
{
503503
JERRY_ASSERT (object_p != NULL && name_p != NULL);
504+
JERRY_ASSERT (ecma_is_lexical_environment (object_p)
505+
|| ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
506+
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
504507
JERRY_ASSERT (ecma_find_named_property (object_p, name_p) == NULL);
505508
JERRY_ASSERT ((prop_attributes & ~ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE) == 0);
506509

@@ -533,6 +536,9 @@ ecma_find_named_property (ecma_object_t *obj_p, /**< object to find property in
533536
{
534537
JERRY_ASSERT (obj_p != NULL);
535538
JERRY_ASSERT (name_p != NULL);
539+
JERRY_ASSERT (ecma_is_lexical_environment (obj_p)
540+
|| ecma_get_object_type (obj_p) != ECMA_OBJECT_TYPE_ARRAY
541+
|| !((ecma_extended_object_t *) obj_p)->u.array.is_fast_mode);
536542

537543
ecma_property_t *property_p = NULL;
538544

‎jerry-core/ecma/builtin-objects/ecma-builtin-string-prototype.c

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1506,13 +1506,17 @@ ecma_builtin_string_prototype_object_split (ecma_value_t this_to_string_val, /**
15061506
ecma_object_t *match_obj_p = ecma_get_object_from_value (match_result);
15071507
ecma_string_t *zero_str_p = ecma_get_ecma_string_from_uint32 (0);
15081508
ecma_string_t *magic_index_str_p = ecma_get_magic_string (LIT_MAGIC_STRING_INDEX);
1509-
ecma_property_value_t *index_prop_value_p;
1509+
ecma_value_t index_prop_value;
15101510

15111511
if (separator_is_regexp)
15121512
{
1513-
index_prop_value_p = ecma_get_named_data_property (match_obj_p, magic_index_str_p);
1513+
JERRY_ASSERT (ecma_get_object_type (match_obj_p) != ECMA_OBJECT_TYPE_ARRAY
1514+
|| !((ecma_extended_object_t *) match_obj_p)->u.array.is_fast_mode);
1515+
1516+
ecma_property_value_t *index_prop_value_p = ecma_get_named_data_property (match_obj_p, magic_index_str_p);
15141517
ecma_number_t index_num = ecma_get_number_from_value (index_prop_value_p->value);
15151518
ecma_value_assign_number (&index_prop_value_p->value, index_num + (ecma_number_t) curr_pos);
1519+
index_prop_value = index_prop_value_p->value;
15161520
}
15171521
else
15181522
{
@@ -1526,14 +1530,14 @@ ecma_builtin_string_prototype_object_split (ecma_value_t this_to_string_val, /**
15261530

15271531
JERRY_ASSERT (ecma_is_value_true (put_comp));
15281532

1529-
index_prop_value_p = ecma_create_named_data_property (match_obj_p,
1530-
magic_index_str_p,
1531-
ECMA_PROPERTY_FLAG_WRITABLE,
1532-
NULL);
1533+
index_prop_value = ecma_make_uint32_value (curr_pos);
1534+
1535+
put_comp = ecma_builtin_helper_def_prop (match_obj_p,
1536+
magic_index_str_p,
1537+
index_prop_value,
1538+
ECMA_PROPERTY_FLAG_WRITABLE);
15331539

1534-
ecma_named_data_property_assign_value (match_obj_p,
1535-
index_prop_value_p,
1536-
ecma_make_uint32_value (curr_pos));
1540+
JERRY_ASSERT (ecma_is_value_true (put_comp));
15371541
}
15381542

15391543
ecma_value_t match_comp_value = ecma_op_object_get (match_obj_p, zero_str_p);
@@ -1546,7 +1550,7 @@ ecma_builtin_string_prototype_object_split (ecma_value_t this_to_string_val, /**
15461550

15471551
ecma_free_value (match_comp_value);
15481552

1549-
ecma_number_t index_num = ecma_get_number_from_value (index_prop_value_p->value);
1553+
ecma_number_t index_num = ecma_get_number_from_value (index_prop_value);
15501554
JERRY_ASSERT (index_num >= 0);
15511555

15521556

‎jerry-core/ecma/operations/ecma-array-object.c

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -943,6 +943,19 @@ ecma_op_array_object_set_length (ecma_object_t *object_p, /**< the array object
943943
return ecma_reject (is_throw);
944944
} /* ecma_op_array_object_set_length */
945945

946+
/**
947+
* Property descriptor bitset for fast array data properties.
948+
* If the property desciptor fields contains all the flags below
949+
* attempt to stay fast access array during [[DefineOwnProperty]] operation.
950+
*/
951+
#define ECMA_FAST_ARRAY_DATA_PROP_FLAGS (ECMA_PROP_IS_VALUE_DEFINED \
952+
| ECMA_PROP_IS_ENUMERABLE_DEFINED \
953+
| ECMA_PROP_IS_ENUMERABLE \
954+
| ECMA_PROP_IS_CONFIGURABLE_DEFINED \
955+
| ECMA_PROP_IS_CONFIGURABLE \
956+
| ECMA_PROP_IS_WRITABLE_DEFINED \
957+
| ECMA_PROP_IS_WRITABLE)
958+
946959
/**
947960
* [[DefineOwnProperty]] ecma array object's operation
948961
*
@@ -1009,13 +1022,24 @@ ecma_op_array_object_define_own_property (ecma_object_t *object_p, /**< the arra
10091022

10101023
ecma_extended_object_t *ext_object_p = (ecma_extended_object_t *) object_p;
10111024

1012-
/* Note for further optimization: for enumerable, configurable, writable data properties
1013-
it's not necessary to convert it back to normal property list based array */
1014-
if (JERRY_UNLIKELY (ext_object_p->u.array.is_fast_mode))
1025+
if (ext_object_p->u.array.is_fast_mode)
10151026
{
1016-
ecma_fast_array_convert_to_normal (object_p);
1027+
if ((property_desc_p->flags & ECMA_FAST_ARRAY_DATA_PROP_FLAGS) == ECMA_FAST_ARRAY_DATA_PROP_FLAGS)
1028+
{
1029+
if (ecma_fast_array_set_property (object_p, property_name_p, property_desc_p->value))
1030+
{
1031+
return ECMA_VALUE_TRUE;
1032+
}
1033+
1034+
JERRY_ASSERT (!ext_object_p->u.array.is_fast_mode);
1035+
}
1036+
else
1037+
{
1038+
ecma_fast_array_convert_to_normal (object_p);
1039+
}
10171040
}
10181041

1042+
JERRY_ASSERT (!ext_object_p->u.array.is_fast_mode);
10191043
uint32_t index = ecma_string_get_array_index (property_name_p);
10201044

10211045
if (index == ECMA_STRING_NOT_ARRAY_INDEX)

‎jerry-core/ecma/operations/ecma-container-object.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,16 @@ ecma_op_container_to_key (ecma_value_t key_arg) /**< key argument */
245245
{
246246
ecma_object_t *obj_p = ecma_get_object_from_value (key_arg);
247247
ecma_string_t *key_string_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_MAP_KEY);
248-
ecma_property_t *property_p = ecma_find_named_property (obj_p, key_string_p);
248+
249+
ecma_property_ref_t property_ref;
250+
ecma_property_t property = ecma_op_object_get_own_property (obj_p,
251+
key_string_p,
252+
&property_ref,
253+
ECMA_PROPERTY_GET_NO_OPTIONS);
254+
249255
ecma_string_t *object_key_string;
250256

251-
if (property_p == NULL)
257+
if (property == ECMA_PROPERTY_TYPE_NOT_FOUND || property == ECMA_PROPERTY_TYPE_NOT_FOUND_AND_STOP)
252258
{
253259
object_key_string = ecma_new_map_key_string (key_arg);
254260
ecma_value_t put_comp = ecma_builtin_helper_def_prop (obj_p,
@@ -261,7 +267,7 @@ ecma_op_container_to_key (ecma_value_t key_arg) /**< key argument */
261267
}
262268
else
263269
{
264-
object_key_string = ecma_get_string_from_value (ECMA_PROPERTY_VALUE_PTR (property_p)->value);
270+
object_key_string = ecma_get_string_from_value (property_ref.value_p->value);
265271
}
266272

267273
ecma_ref_ecma_string (object_key_string);
@@ -383,7 +389,7 @@ ecma_value_t
383389
ecma_op_container_set (ecma_value_t this_arg, /**< this argument */
384390
ecma_value_t key_arg, /**< key argument */
385391
ecma_value_t value_arg, /**< value argument */
386-
lit_magic_string_id_t lit_id) /**< internal class id */
392+
lit_magic_string_id_t lit_id) /**< internal class id */
387393
{
388394
ecma_map_object_t *map_object_p = ecma_op_container_get_object (this_arg, lit_id);
389395

‎jerry-core/ecma/operations/ecma-objects-general.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,8 @@ ecma_op_general_object_define_own_property (ecma_object_t *object_p, /**< the ob
284284
{
285285
JERRY_ASSERT (object_p != NULL
286286
&& !ecma_is_lexical_environment (object_p));
287+
JERRY_ASSERT (ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
288+
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
287289
JERRY_ASSERT (property_name_p != NULL);
288290

289291
ecma_property_types_t property_desc_type = ECMA_PROPERTY_TYPE_GENERIC;

‎jerry-core/ecma/operations/ecma-objects.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -744,6 +744,10 @@ inline ecma_value_t JERRY_ATTR_ALWAYS_INLINE
744744
ecma_op_object_get_own_data_prop (ecma_object_t *object_p, /**< the object */
745745
ecma_string_t *property_name_p) /**< property name */
746746
{
747+
JERRY_ASSERT (ecma_is_lexical_environment (object_p)
748+
|| ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
749+
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
750+
747751
ecma_value_t result = ecma_op_object_find_own (ecma_make_object_value (object_p),
748752
object_p,
749753
property_name_p);

‎jerry-core/ecma/operations/ecma-regexp-object.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1395,6 +1395,8 @@ ecma_regexp_exec_helper (ecma_value_t regexp_value, /**< RegExp object */
13951395
capture_value = ecma_make_string_value (capture_str_p);
13961396
}
13971397

1398+
JERRY_ASSERT (!((ecma_extended_object_t *) result_array_obj_p)->u.array.is_fast_mode);
1399+
13981400
ecma_property_value_t *prop_value_p;
13991401
prop_value_p = ecma_create_named_data_property (result_array_obj_p,
14001402
index_str_p,

‎jerry-core/vm/opcodes.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,10 @@ opfunc_set_accessor (bool is_getter, /**< is getter accessor */
9191
ecma_value_t accessor) /**< accessor value */
9292
{
9393
ecma_object_t *object_p = ecma_get_object_from_value (object);
94+
95+
JERRY_ASSERT (ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
96+
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
97+
9498
ecma_property_t *property_p = ecma_find_named_property (object_p, accessor_name_p);
9599

96100
if (property_p != NULL

‎jerry-core/vm/vm.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1259,6 +1259,10 @@ vm_loop (vm_frame_ctx_t *frame_ctx_p) /**< frame context */
12591259
#endif /* ENABLED (JERRY_ES2015_CLASS) */
12601260

12611261
ecma_object_t *object_p = ecma_get_object_from_value (stack_top_p[index]);
1262+
1263+
JERRY_ASSERT (ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
1264+
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
1265+
12621266
ecma_property_t *property_p = ecma_find_named_property (object_p, prop_name_p);
12631267

12641268
if (property_p != NULL

0 commit comments

Comments
 (0)