Changeset 196361 in webkit

Timestamp:

Feb 9, 2016 10:01:28 PM (8 years ago)

Author:

keith_miller@apple.com

Message:

calling methods off super in a class constructor should check for TDZ
​https://bugs.webkit.org/show_bug.cgi?id=154060

Reviewed by Ryosuke Niwa.

In a class constructor we need to check for TDZ when calling a method
off the super class. This is because, for super method calls, we use
the derived class's newly constructed object as the super method's
this value.

• bytecompiler/NodesCodegen.cpp:

(JSC::FunctionCallDotNode::emitBytecode):

• tests/stress/super-method-calls-check-tdz.js: Added.

(Base):
(Derived):
(test):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/NodesCodegen.cpp (modified) (1 diff)
• tests/stress/super-method-calls-check-tdz.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-02-09  Keith Miller  <keith_miller@apple.com>
+
+        calling methods off super in a class constructor should check for TDZ
+        https://bugs.webkit.org/show_bug.cgi?id=154060
+
+        Reviewed by Ryosuke Niwa.
+
+        In a class constructor we need to check for TDZ when calling a method
+        off the super class. This is because, for super method calls, we use
+        the derived class's newly constructed object as the super method's
+        this value.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * tests/stress/super-method-calls-check-tdz.js: Added.
+        (Base):
+        (Derived):
+        (test):
+
 2016-02-09  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -919 +919 @@
     CallArguments callArguments(generator, m_args);
     bool baseIsSuper = m_base->isSuperNode();
-    if (baseIsSuper)
+    if (baseIsSuper) {
+        generator.emitTDZCheck(generator.thisRegister());
         generator.emitMove(callArguments.thisRegister(), generator.thisRegister());
-    else
+    } else
         generator.emitNode(callArguments.thisRegister(), m_base);
     generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());