Skip to content

Commit 3f0a357

Browse files
chicoxyzzykmiller68
chicoxyzzy
authored and
kmiller68
committed
[JSC] Avoid $vm dictionary transitions on Wasm GC objects
https://bugs.webkit.org/show_bug.cgi?id=320759 Reviewed by Keith Miller. $vm.toCacheableDictionary and $vm.toUncacheableDictionary passed any JSObject into structure dictionary transitions. Wasm GC objects have no butterfly, so that hit RELEASE_ASSERT on WebAssemblyGCStructure. Only convert JSObjectWithButterfly, same as ensureArrayStorage. * Source/JavaScriptCore/tools/JSDollarVM.cpp: (JSC::functionToCacheableDictionary): (JSC::functionToUncacheableDictionary): * JSTests/wasm/gc/no-gc-structure-transition.js: (testDollarVMDictionaryHelpers): Canonical link: https://commits.webkit.org/318552@main
1 parent 00309e0 commit 3f0a357

2 files changed

Lines changed: 25 additions & 3 deletions

File tree

‎JSTests/wasm/gc/no-gc-structure-transition.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -719,6 +719,24 @@ function testEnsureArrayStorageViaWasmImport() {
719719
assert.eq(m.exports.get(obj), 42);
720720
}
721721

722+
// https://bugs.webkit.org/show_bug.cgi?id=320759
723+
function testDollarVMDictionaryHelpers() {
724+
if (typeof $vm === "undefined")
725+
return;
726+
727+
const ms = makeStruct();
728+
const s = ms.exports.make();
729+
$vm.toCacheableDictionary(s);
730+
$vm.toUncacheableDictionary(s);
731+
verifyStructIntact(ms, s);
732+
733+
const ma = makeArray();
734+
const a = ma.exports.make();
735+
$vm.toCacheableDictionary(a);
736+
$vm.toUncacheableDictionary(a);
737+
verifyArrayIntact(ma, a);
738+
}
739+
722740
// Run all tests
723741
testPropertyAdditionNamed();
724742
testPropertyAdditionIndexed();
@@ -755,3 +773,4 @@ testIsExtensible();
755773
testPropertyEnumeration();
756774
testEnsureArrayStorage();
757775
testEnsureArrayStorageViaWasmImport();
776+
testDollarVMDictionaryHelpers();

‎Source/JavaScriptCore/tools/JSDollarVM.cpp‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4230,8 +4230,10 @@ JSC_DEFINE_HOST_FUNCTION(functionToCacheableDictionary, (JSGlobalObject* globalO
42304230
JSObject* object = dynamicDowncast<JSObject>(callFrame->argument(0));
42314231
if (!object)
42324232
return throwVMTypeError(globalObject, scope, "Expected first argument to be an object"_s);
4233-
if (!object->structure()->isUncacheableDictionary())
4234-
object->convertToDictionary(vm);
4233+
if (auto* objectWithButterfly = dynamicDowncast<JSObjectWithButterfly>(object)) {
4234+
if (!objectWithButterfly->structure()->isUncacheableDictionary())
4235+
objectWithButterfly->convertToDictionary(vm);
4236+
}
42354237
return JSValue::encode(object);
42364238
}
42374239

@@ -4244,7 +4246,8 @@ JSC_DEFINE_HOST_FUNCTION(functionToUncacheableDictionary, (JSGlobalObject* globa
42444246
JSObject* object = dynamicDowncast<JSObject>(callFrame->argument(0));
42454247
if (!object)
42464248
return throwVMTypeError(globalObject, scope, "Expected first argument to be an object"_s);
4247-
object->convertToUncacheableDictionary(vm);
4249+
if (auto* objectWithButterfly = dynamicDowncast<JSObjectWithButterfly>(object))
4250+
objectWithButterfly->convertToUncacheableDictionary(vm);
42484251
return JSValue::encode(object);
42494252
}
42504253

0 commit comments

Comments
 (0)