Attachment #395703 for bug #200560

View Details Raw Unified Return to Bug 200560

| Differences between



2020-04-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] Fix DebuggerScope and/or ProxyObject to remove a hack in JSObject::getOwnPropertyDescriptor
        https://bugs.webkit.org/show_bug.cgi?id=200560

        Reviewed by NOBODY (OOPS!).

        * test262/expectations.yaml:

2020-04-07  Yusuke Suzuki  <ysuzuki@apple.com>

        [JSC] Inlined IC should get right JSGlobalObject



test/built-ins/Array/prototype/splice/clamps-length-to-integer-limit.js:
  default: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'
  strict mode: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'
test/built-ins/Array/prototype/splice/create-proxy.js:
  default: 'TypeError: Attempted to assign to readonly property.'
  strict mode: 'TypeError: Attempted to assign to readonly property.'
test/built-ins/Array/prototype/splice/create-species-length-exceeding-integer-limit.js:
  default: 'Test262Error: length and deleteCount were correctly clamped to 2^53-1 Expected SameValue(«4294967295», «9007199254740991») to be true'
  strict mode: 'Test262Error: length and deleteCount were correctly clamped to 2^53-1 Expected SameValue(«4294967295», «9007199254740991») to be true'

test/built-ins/Proxy/defineProperty/trap-is-undefined-target-is-proxy.js:
  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-missing-target-is-proxy.js:
  default: "TypeError: undefined is not an object (evaluating 'originalDesc.enumerable')"
  strict mode: "TypeError: undefined is not an object (evaluating 'originalDesc.enumerable')"
test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-null-target-is-proxy.js:
  default: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
  strict mode: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-undefined-target-is-proxy.js:
  default: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
  strict mode: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
test/built-ins/Proxy/ownKeys/trap-is-undefined-target-is-proxy.js:
  default: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '
  strict mode: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '

test/built-ins/Proxy/set/trap-is-missing-receiver-multiple-calls.js:
  default: 'Test262Error: Expected [foo] and [foo, foo, foo] to have the same contents. getOwnPropertyDescriptor: key present on [[ProxyTarget]]'
  strict mode: 'TypeError: Attempted to assign to readonly property.'
test/built-ins/Proxy/set/trap-is-missing-target-is-proxy.js:
  default: 'Test262Error: Expected SameValue(«0», «1») to be true'
  strict mode: 'TypeError: Attempting to change configurable attribute of unconfigurable property.'
test/built-ins/Proxy/set/trap-is-null-target-is-proxy.js:
  default: 'Test262Error: Expected [1, 2, 3] and [] to have the same contents. '
  strict mode: 'TypeError: Attempting to change configurable attribute of unconfigurable property.'
test/built-ins/Proxy/set/trap-is-undefined-target-is-proxy.js:
  default: 'Test262Error: Expected true but got false'
  strict mode: 'Test262Error: Expected true but got false'
test/built-ins/Reflect/ownKeys/order-after-define-property.js:
  default: 'Test262Error: Expected [Symbol(b), Symbol(a)] and [Symbol(a), Symbol(b)] to have the same contents. '
  strict mode: 'Test262Error: Expected [Symbol(b), Symbol(a)] and [Symbol(a), Symbol(b)] to have the same contents. '



2020-04-07  Alexey Shvayka  <shvaikalesh@gmail.com>

        [JSC] Fix DebuggerScope and/or ProxyObject to remove a hack in JSObject::getOwnPropertyDescriptor
        https://bugs.webkit.org/show_bug.cgi?id=200560

        Reviewed by NOBODY (OOPS!).

        This change removes a hack from JSObject::getOwnPropertyDescriptor,
        allowing a Proxy object w/o both "set" and "getOwnPropertyDescriptor"
        traps and with another Proxy as its [[ProxyTarget]] work correctly.

        * runtime/JSObject.cpp:
        (JSC::JSObject::getOwnPropertyDescriptor):

2020-04-04  Alexey Shvayka  <shvaikalesh@gmail.com>

        '\u' should throw an early SyntaxError exception, but instead evaluates to 'u'



    if (!result)
        return false;


    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=200560
    // This breaks the assumption that getOwnPropertySlot should return "own" property.
    // We should fix DebuggerScope, ProxyObject etc. to remove this.
    //
    // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain
    // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that
    // the property is not an own property.
    if (slot.slotBase() != this && slot.slotBase()) {
        JSProxy* jsProxy = jsDynamicCast<JSProxy*>(vm, this);
        if (!jsProxy || jsProxy->target() != slot.slotBase()) {
            // Try ProxyObject.
            ProxyObject* proxyObject = jsDynamicCast<ProxyObject*>(vm, this);
            if (!proxyObject || proxyObject->target() != slot.slotBase())
                return false;
        }
    }

    if (slot.isAccessor())
        descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
    else if (slot.attributes() & PropertyAttribute::CustomAccessor) {

Return to Bug 200560

Lines 3491-3514 bool JSObject::getOwnPropertyDescriptor( Source/JavaScriptCore/runtime/JSObject.cpp_sec1
- Source/JavaScriptCore/runtime/JSObject.cpp -18 lines
3491	if (!result)	3491	if (!result)
3492	return false;	3492	return false;
3493		3493
3494
3495	// FIXME: https://bugs.webkit.org/show_bug.cgi?id=200560
3496	// This breaks the assumption that getOwnPropertySlot should return "own" property.
3497	// We should fix DebuggerScope, ProxyObject etc. to remove this.
3498	//
3499	// DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain
3500	// but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that
3501	// the property is not an own property.
3502	if (slot.slotBase() != this && slot.slotBase()) {
3503	JSProxy* jsProxy = jsDynamicCast<JSProxy*>(vm, this);
3504	if (!jsProxy \|\| jsProxy->target() != slot.slotBase()) {
3505	// Try ProxyObject.
3506	ProxyObject* proxyObject = jsDynamicCast<ProxyObject*>(vm, this);
3507	if (!proxyObject \|\| proxyObject->target() != slot.slotBase())
3508	return false;
3509	}
3510	}
3511
3512	if (slot.isAccessor())	3494	if (slot.isAccessor())
3513	descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());	3495	descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
3514	else if (slot.attributes() & PropertyAttribute::CustomAccessor) {	3496	else if (slot.attributes() & PropertyAttribute::CustomAccessor) {

Lines 1-3 JSTests/ChangeLog_sec1
- JSTests/ChangeLog +9 lines
		1	2020-04-07 Alexey Shvayka <shvaikalesh@gmail.com>
		2
		3	[JSC] Fix DebuggerScope and/or ProxyObject to remove a hack in JSObject::getOwnPropertyDescriptor
		4	https://bugs.webkit.org/show_bug.cgi?id=200560
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* test262/expectations.yaml:
		9
1	2020-04-07 Yusuke Suzuki <ysuzuki@apple.com>	10	2020-04-07 Yusuke Suzuki <ysuzuki@apple.com>
2		11
3	[JSC] Inlined IC should get right JSGlobalObject	12	[JSC] Inlined IC should get right JSGlobalObject

Lines 672-680 test/built-ins/Array/prototype/splice/S1 JSTests/test262/expectations.yaml_sec1
- JSTests/test262/expectations.yaml -21 lines
672	test/built-ins/Array/prototype/splice/clamps-length-to-integer-limit.js:	672	test/built-ins/Array/prototype/splice/clamps-length-to-integer-limit.js:
673	default: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'	673	default: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'
674	strict mode: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'	674	strict mode: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'
675	test/built-ins/Array/prototype/splice/create-proxy.js:
676	default: 'TypeError: Attempted to assign to readonly property.'
677	strict mode: 'TypeError: Attempted to assign to readonly property.'
678	test/built-ins/Array/prototype/splice/create-species-length-exceeding-integer-limit.js:	675	test/built-ins/Array/prototype/splice/create-species-length-exceeding-integer-limit.js:
679	default: 'Test262Error: length and deleteCount were correctly clamped to 2^53-1 Expected SameValue(«4294967295», «9007199254740991») to be true'	676	default: 'Test262Error: length and deleteCount were correctly clamped to 2^53-1 Expected SameValue(«4294967295», «9007199254740991») to be true'
680	strict mode: 'Test262Error: length and deleteCount were correctly clamped to 2^53-1 Expected SameValue(«4294967295», «9007199254740991») to be true'	677	strict mode: 'Test262Error: length and deleteCount were correctly clamped to 2^53-1 Expected SameValue(«4294967295», «9007199254740991») to be true'
Lines 1234-1248 test/built-ins/Proxy/create-target-is-re JSTests/test262/expectations.yaml_sec2
1234	test/built-ins/Proxy/defineProperty/trap-is-undefined-target-is-proxy.js:	1231	test/built-ins/Proxy/defineProperty/trap-is-undefined-target-is-proxy.js:
1235	default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'	1232	default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
1236	strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'	1233	strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
1237	test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-missing-target-is-proxy.js:
1238	default: "TypeError: undefined is not an object (evaluating 'originalDesc.enumerable')"
1239	strict mode: "TypeError: undefined is not an object (evaluating 'originalDesc.enumerable')"
1240	test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-null-target-is-proxy.js:
1241	default: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
1242	strict mode: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
1243	test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-undefined-target-is-proxy.js:
1244	default: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
1245	strict mode: "TypeError: undefined is not an object (evaluating 'originalDesc.value')"
1246	test/built-ins/Proxy/ownKeys/trap-is-undefined-target-is-proxy.js:	1234	test/built-ins/Proxy/ownKeys/trap-is-undefined-target-is-proxy.js:
1247	default: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '	1235	default: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '
1248	strict mode: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '	1236	strict mode: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '
Lines 1252-1266 test/built-ins/Proxy/set/trap-is-missing JSTests/test262/expectations.yaml_sec3
1252	test/built-ins/Proxy/set/trap-is-missing-receiver-multiple-calls.js:	1240	test/built-ins/Proxy/set/trap-is-missing-receiver-multiple-calls.js:
1253	default: 'Test262Error: Expected [foo] and [foo, foo, foo] to have the same contents. getOwnPropertyDescriptor: key present on [[ProxyTarget]]'	1241	default: 'Test262Error: Expected [foo] and [foo, foo, foo] to have the same contents. getOwnPropertyDescriptor: key present on [[ProxyTarget]]'
1254	strict mode: 'TypeError: Attempted to assign to readonly property.'	1242	strict mode: 'TypeError: Attempted to assign to readonly property.'
1255	test/built-ins/Proxy/set/trap-is-missing-target-is-proxy.js:
1256	default: 'Test262Error: Expected SameValue(«0», «1») to be true'
1257	strict mode: 'TypeError: Attempting to change configurable attribute of unconfigurable property.'
1258	test/built-ins/Proxy/set/trap-is-null-target-is-proxy.js:
1259	default: 'Test262Error: Expected [1, 2, 3] and [] to have the same contents. '
1260	strict mode: 'TypeError: Attempting to change configurable attribute of unconfigurable property.'
1261	test/built-ins/Proxy/set/trap-is-undefined-target-is-proxy.js:
1262	default: 'Test262Error: Expected true but got false'
1263	strict mode: 'Test262Error: Expected true but got false'
1264	test/built-ins/Reflect/ownKeys/order-after-define-property.js:	1243	test/built-ins/Reflect/ownKeys/order-after-define-property.js:
1265	default: 'Test262Error: Expected [Symbol(b), Symbol(a)] and [Symbol(a), Symbol(b)] to have the same contents. '	1244	default: 'Test262Error: Expected [Symbol(b), Symbol(a)] and [Symbol(a), Symbol(b)] to have the same contents. '
1266	strict mode: 'Test262Error: Expected [Symbol(b), Symbol(a)] and [Symbol(a), Symbol(b)] to have the same contents. '	1245	strict mode: 'Test262Error: Expected [Symbol(b), Symbol(a)] and [Symbol(a), Symbol(b)] to have the same contents. '

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +14 lines
		1	2020-04-07 Alexey Shvayka <shvaikalesh@gmail.com>
		2
		3	[JSC] Fix DebuggerScope and/or ProxyObject to remove a hack in JSObject::getOwnPropertyDescriptor
		4	https://bugs.webkit.org/show_bug.cgi?id=200560
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	This change removes a hack from JSObject::getOwnPropertyDescriptor,
		9	allowing a Proxy object w/o both "set" and "getOwnPropertyDescriptor"
		10	traps and with another Proxy as its [[ProxyTarget]] work correctly.
		11
		12	* runtime/JSObject.cpp:
		13	(JSC::JSObject::getOwnPropertyDescriptor):
		14
1	2020-04-04 Alexey Shvayka <shvaikalesh@gmail.com>	15	2020-04-04 Alexey Shvayka <shvaikalesh@gmail.com>
2		16
3	'\u' should throw an early SyntaxError exception, but instead evaluates to 'u'	17	'\u' should throw an early SyntaxError exception, but instead evaluates to 'u'