← All issues

JSC: cache isDefinitelyNonThenable on Structure

cdf77b6

Source/JavaScriptCore/runtime/Structure.h

+enum class NonThenableStatus : uint8_t { Unknown, NonThenable, MaybeThenable, Uncacheable };
+NonThenableStatus nonThenableStatus() const { return m_nonThenableStatus; }
+void setNonThenableStatus(NonThenableStatus status) { m_nonThenableStatus = status; }

ECMAScript requires Promise.resolve and await to detect thenables by walking the prototype chain for a callable .then. JSC's isDefinitelyNonThenable() did this walk on every call. This commit caches the result on each Structure using a 2-bit lazy state (Unknown, NonThenable, MaybeThenable, Uncacheable). The NonThenable state is trusted only while the realm's promiseThenWatchpointSet is intact — now extended to cover then-absence on Object.prototype as well. Chains deeper than [self, Object.prototype] or [self] (null proto) are marked Uncacheable; dictionary structures are excluded.

This change sits directly on the thenable-detection path, where a misclassification turns a thenable into a plain value — a potential capability bypass if promise-guarded objects can be smuggled through as non-thenables.

🔒

The watchpoint-to-cache trust chain, realm boundary enforcement, and structure mutation edge cases are worth security investigation.

더 확인하려면 구독해 주세요