AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

X87: Only dynamically perform access checks on the receiver if it's a JSGlobalProxy.

Browse Source 
port e9cdcb7174 (r26875)

original commit message:
  Only dynamically perform access checks on the receiver if it's a JSGlobalProxy.
  Proxies up the chain are guaranteed to provide access if we had access to the receiver,
  since otherwise we wouldn't have been able to compile the stub in the first place.
  If the security check would change, the window navigates, changing the map of the JSGlobalProxy.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/964813002

Cr-Commit-Position: refs/heads/master@{#26905}
This commit is contained in:
cdai2 2015-02-27 15:31:45 +08:00
parent e1030fc97d
commit 852792048c
1 changed files with 12 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
src/ic/x87/handler-compiler-x87.cc
View File

@ -431,6 +431,17 @@ Register PropertyHandlerCompiler::CheckPrototypes(
if (receiver_map->IsJSGlobalObjectMap()) {
current = isolate()->global_object();
}
// Check access rights to the global object. This has to happen after
// the map check so that we know that the object is actually a global
// object.
// This allows us to install generated handlers for accesses to the
// global proxy (as opposed to using slow ICs). See corresponding code
// in LookupForRead().
if (receiver_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
}
Handle<JSObject> prototype = Handle<JSObject>::null();
Handle<Map> current_map = receiver_map;
Handle<Map> holder_map(holder()->map());
@ -471,17 +482,7 @@ Register PropertyHandlerCompiler::CheckPrototypes(
__ j(not_equal, miss);
}
// Check access rights to the global object. This has to happen after
// the map check so that we know that the object is actually a global
// object.
// This allows us to install generated handlers for accesses to the
// global proxy (as opposed to using slow ICs). See corresponding code
// in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, map_reg, scratch2, miss);
// Restore map_reg.
__ mov(map_reg, FieldOperand(reg, HeapObject::kMapOffset));
} else if (current_map->IsJSGlobalObjectMap()) {
if (current_map->IsJSGlobalObjectMap()) {
GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
name, scratch2, miss);
}
@ -505,13 +506,6 @@ Register PropertyHandlerCompiler::CheckPrototypes(
__ j(not_equal, miss);
}
// Perform security check for access to the global object.
DCHECK(current_map->IsJSGlobalProxyMap() ||
!current_map->is_access_check_needed());
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
}
// Return the register containing the holder.
return reg;
}