Changeset 272411 in webkit

Timestamp:

Feb 5, 2021 6:26:44 AM (18 months ago)

Author:

Alexey Shvayka

Message:

Object.assign should throw for property creation on non-extensible target
​https://bugs.webkit.org/show_bug.cgi?id=220712

Reviewed by Ross Kirsling.

JSTests:

• stress/object-assign-fast-path.js:

Source/JavaScriptCore:

This performance-neutral change precludes Object.assign from taking the
fast path if target is a non-extensible JSFinalObject, which ensures
a TypeError is thrown for property creation via Set?.

Aligns JSC with the spec [1], V8, and SpiderMonkey.

[1]: ​https://tc39.es/ecma262/#sec-validateandapplypropertydescriptor (step 2.a)

• runtime/ObjectConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/object-assign-fast-path.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ObjectConstructor.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-02-05  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        Object.assign should throw for property creation on non-extensible `target`
+        https://bugs.webkit.org/show_bug.cgi?id=220712
+
+        Reviewed by Ross Kirsling.
+
+        * stress/object-assign-fast-path.js:
+
 2021-02-05  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/JSTests/stress/object-assign-fast-path.js

@@ -164 +164 @@
     shouldBe(setterCalledWithValue, "world");
 }
+{
+    let object = Object.freeze({ foo: 1 });
+    shouldBe(Object.assign(object, {}), object);
+}
+{
+    let object = Object.preventExtensions({ foo: 1 });
+    shouldBe(Object.assign(object, { foo: 2 }), object);
+    shouldBe(object.foo, 2);
+}
+{
+    let object = Object.preventExtensions({ foo: 1 });
+    shouldThrow(() => {
+        Object.assign(object, { bar: 2 });
+    }, `TypeError: Attempted to assign to readonly property.`);
+    shouldBe(object.bar, undefined);
+}

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-02-05  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        Object.assign should throw for property creation on non-extensible `target`
+        https://bugs.webkit.org/show_bug.cgi?id=220712
+
+        Reviewed by Ross Kirsling.
+
+        This performance-neutral change precludes Object.assign from taking the
+        fast path if `target` is a non-extensible JSFinalObject, which ensures
+        a TypeError is thrown for property creation via [[Set]].
+
+        Aligns JSC with the spec [1], V8, and SpiderMonkey.
+
+        [1]: https://tc39.es/ecma262/#sec-validateandapplypropertydescriptor (step 2.a)
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::JSC_DEFINE_HOST_FUNCTION):
+
 2021-02-05  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

@@ -274 +274 @@
     // FIXME: Extend this for non JSFinalObject. For example, we would like to use this fast path for function objects too.
     // https://bugs.webkit.org/show_bug.cgi?id=185358
-    bool targetCanPerformFastPut = jsDynamicCast<JSFinalObject*>(vm, target) && target->canPerformFastPutInlineExcludingProto(vm);
+    bool targetCanPerformFastPut = jsDynamicCast<JSFinalObject*>(vm, target) && target->canPerformFastPutInlineExcludingProto(vm) && target->isStructureExtensible(vm);
 
     Vector<RefPtr<UniquedStringImpl>, 8> properties;