Attachment 387383 Details for Bug 205983 – Patch

[patch] Patch

bug-205983-20200109071526-2.patch (text/plain), 4.76 KB, created by Alexey Shvayka on 2020-01-10 15:18:09 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Alexey Shvayka

Created: 2020-01-10 15:18:09 PST

Size: 4.76 KB

patch

obsolete

>Subversion Revision: 254107
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 463c9cd4a2bd0c409f072ec9bcb4ab67b36831f7..c7a4ce607ababd7069b8dc0b08e5650926b9ee6f 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,20 @@
>+2020-01-08  Caitlin Potter  <caitp@igalia.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.keys should throw if called on module namespace object with uninitialized binding
>+        https://bugs.webkit.org/show_bug.cgi?id=205983
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        If JSModuleNamespaceObject::getOwnPropertyNames method is called by
>+        Object.keys or for/in loop, it should invoke [[GetOwnProperty]] on
>+        every binding so a ReferenceError is thrown if the binding is uninitialized.
>+
>+        Complete call stack of internal methods and abstract ops is in "info" meta of
>+        JSTests/test262/test/language/module-code/namespace/internals/object-keys-binding-uninit.js
>+
>+        * runtime/JSModuleNamespaceObject.cpp:
>+        (JSC::JSModuleNamespaceObject::getOwnPropertyNames):
>+
> 2020-01-06  Alexey Shvayka  <shvaikalesh@gmail.com>
> 
>         String.prototype.replace() incorrectly handles named references on RegExp w/o named groups
>diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
>index 175686dcc683bef2f7c3dbdd10d480a2286074b2..2bdb1305eb0c4be9608065bd34859c7af148b2a1 100644
>--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
>@@ -211,11 +211,21 @@ bool JSModuleNamespaceObject::deleteProperty(JSCell* cell, JSGlobalObject* globa
> 
> void JSModuleNamespaceObject::getOwnPropertyNames(JSObject* cell, JSGlobalObject* globalObject, PropertyNameArray& propertyNames, EnumerationMode mode)
> {
>-    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-ownpropertykeys
>+    VM& vm = globalObject->vm();
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    // https://tc39.es/ecma262/#sec-module-namespace-exotic-objects-ownpropertykeys
>     JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
>-    for (const auto& name : thisObject->m_names)
>+    for (const auto& name : thisObject->m_names) {
>+        if (!mode.includeDontEnumProperties()) {
>+            // Perform [[GetOwnProperty]] to throw ReferenceError if binding is uninitialized.
>+            PropertySlot slot(cell, PropertySlot::InternalMethodType::GetOwnProperty);
>+            thisObject->getOwnPropertySlotCommon(globalObject, name.impl(), slot);
>+            RETURN_IF_EXCEPTION(scope, void());
>+        }
>         propertyNames.add(name.impl());
>-    return JSObject::getOwnPropertyNames(thisObject, globalObject, propertyNames, mode);
>+    }
>+    JSObject::getOwnPropertyNames(thisObject, globalObject, propertyNames, mode);
> }
> 
> bool JSModuleNamespaceObject::defineOwnProperty(JSObject*, JSGlobalObject* globalObject, PropertyName, const PropertyDescriptor&, bool shouldThrow)
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 883ee7dee19ae606928a1fbd6a6899a02c135af7..d9a4f2375fb8c252a457b80f1ed45e18250c7c43 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2020-01-08  Caitlin Potter  <caitp@igalia.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
>+
>+        Object.keys should throw if called on module namespace object with uninitialized binding
>+        https://bugs.webkit.org/show_bug.cgi?id=205983
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * test262/expectations.yaml: Mark 2 test cases as passing.
>+
> 2020-01-06  Alexey Shvayka  <shvaikalesh@gmail.com>
> 
>         String.prototype.replace() incorrectly handles named references on RegExp w/o named groups
>diff --git a/JSTests/test262/expectations.yaml b/JSTests/test262/expectations.yaml
>index 9dae1811bf00b28ec73e792b41770a77b9d03685..6adaf9824582279063b4fb0c198b26a25f1782ab 100644
>--- a/JSTests/test262/expectations.yaml
>+++ b/JSTests/test262/expectations.yaml
>@@ -3504,8 +3504,6 @@ test/language/module-code/namespace/internals/get-nested-namespace-dflt-skip.js:
>   module: "SyntaxError: Unexpected identifier 'as'. Expected 'from' before exported module name."
> test/language/module-code/namespace/internals/get-nested-namespace-props-nrml.js:
>   module: "SyntaxError: Unexpected identifier 'as'. Expected 'from' before exported module name."
>-test/language/module-code/namespace/internals/object-keys-binding-uninit.js:
>-  module: 'Test262Error: Expected a ReferenceError to be thrown but no exception was thrown at all'
> test/language/module-code/namespace/internals/set.js:
>   module: 'Test262Error: Reflect.defineProperty: local1 Expected SameValue(Â«falseÂ», Â«trueÂ») to be true'
> test/language/module-code/parse-err-hoist-lex-fun.js:

Actions: View | Formatted Diff | Diff

Attachments on bug 205983: 387186 | 387383