Repository navigation
fix(patches): own-property lookups through a non-masking interceptor - #11
Merged
Merged
Conversation
If a receiver has a kNonMasking named interceptor and an object on its
prototype chain has a named interceptor of its own, an own-property
lookup on the receiver ended on that prototype instead of NOT_FOUND.
LookupIterator::NextInternal meant to treat the prototype's interceptor
as invisible, but it `continue`d inside `do { } while (!IsFound())`
while the state was still INTERCEPTOR, so the walk stopped there.
Prototype properties then read as own, `delete obj.m` removed `m` from
the prototype, and sets and defineProperty reached the prototype's
interceptor instead of the receiver's.
v8_nonmasking_own_lookup.patch steps past the invisible interceptor (or
a passed access check) within the same holder, so its real properties
still count, and only moves on when nothing is found there. Indexed
interceptors are no longer skipped, matching upstream since
892dda71342. Reported upstream as crbug 585053531; applied on every
platform.
The iOS runtime's wrapper canary mode puts kNonMasking interceptors on
ObjC instances, whose prototypes already carry a named interceptor.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
v8_nonmasking_own_lookup.patch, a fix for a V8 lookup bug reported upstream as crbug 585053531. The iOS runtime needs it for an upcoming wrapper lifetime mode that putskNonMaskinginterceptors on ObjC instances.The bug
If a receiver has a
kNonMaskingnamed interceptor and an object on its prototype chain has a named interceptor of its own, an own-property lookup on the receiver ends on that prototype instead ofNOT_FOUND:Object.hasOwn(obj, "m")istruefor a prototype-onlym, andgetOwnPropertyDescriptorreturns a descriptor with novalue;delete obj.mdeletesmfrom the prototype, for every object sharing it;obj.x = vandObject.defineProperty(obj, "x", …)reach the prototype's setter or definer interceptor instead of the receiver's.In
LookupIterator::NextInternal, the visibility walk means to skip the prototype's interceptor (WebIDL named-property visibility), but itcontinues insidedo { } while (!IsFound())whilestate_is stillINTERCEPTOR, so the loop exits on the prototype.The patch
It steps past the invisible interceptor (or a passed access check) within the same holder, so that holder's real properties still count, and moves to the next holder only when nothing is found there. Indexed interceptors are no longer skipped, which is what upstream main has done since 892dda71342.
When upstream fixes it, the patch is dropped on the next V8 bump.