Changeset 202796 in webkit

Timestamp:

Jul 3, 2016 8:25:04 PM (8 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC] lookupGetter and lookupSetter should not ignore exceptions
​https://bugs.webkit.org/show_bug.cgi?id=159390

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-07-03
Reviewed by Mark Lam.

Source/JavaScriptCore:

See:
-​https://tc39.github.io/ecma262/#sec-object.prototype.__lookupGetter
-​https://tc39.github.io/ecma262/#sec-object.prototype.__lookupSetter

They are both supposed to be regular GetOwnProperty?.

• runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):

LayoutTests:

• js/property-getters-and-setters-expected.txt:
• js/script-tests/property-getters-and-setters.js:

(getter17):
(get getter17):
(getOwnPropertyDescriptor):
(setter18):
(set setter18):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/property-getters-and-setters-expected.txt (modified) (1 diff)
• LayoutTests/js/script-tests/property-getters-and-setters.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ObjectPrototype.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-07-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] __lookupGetter__ and __lookupSetter__ should not ignore exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=159390
+
+        Reviewed by Mark Lam.
+
+        * js/property-getters-and-setters-expected.txt:
+        * js/script-tests/property-getters-and-setters.js:
+        (getter17):
+        (get getter17):
+        (getOwnPropertyDescriptor):
+        (setter18):
+        (set setter18):
+
 2016-07-03  Frederic Wang  <fred.wang@free.fr>
 

trunk/LayoutTests/js/property-getters-and-setters-expected.txt

@@ -59 +59 @@
 PASS o16.__defineSetter__('b', function(){}) threw exception TypeError: Attempting to change configurable attribute of unconfigurable property..
 PASS o16.__defineSetter__('b', function(){}) threw exception TypeError: Attempting to change configurable attribute of unconfigurable property..
+__lookupGetter__ can be interrupted by a proxy throwing an exception
+PASS o17.property is "WebKit!"
+PASS o17.__lookupGetter__('property') is getter17
+PASS o17.__lookupSetter__('property') is undefined
+PASS o17Proxy.__lookupGetter__('property') threw exception o17 Proxy raised exception.
+PASS o17Proxy.__lookupSetter__('property') threw exception o17 Proxy raised exception.
+PASS o17Proxy.property is "WebKit!"
+PASS o17.property is "WebKit!"
+PASS o17.__lookupGetter__('property') is getter17
+__lookupSetter__ can be interrupted by a proxy throwing an exception
+PASS o18.property = 5 is 5
+PASS o18.property is undefined
+PASS o18.value is 5
+PASS o18.__lookupGetter__('property') is undefined
+PASS o18.__lookupSetter__('property') is setter18
+PASS o18Proxy.__lookupGetter__('property') threw exception o18 Proxy raised exception.
+PASS o18Proxy.__lookupSetter__('property') threw exception o18 Proxy raised exception.
+PASS o18Proxy.property = 'JavaScriptCore!' threw exception o18 Proxy raised exception.
+PASS o18Proxy.property is undefined
+PASS o18Proxy.value is 5
+PASS o18.property = 'JavaScriptCore!' is "JavaScriptCore!"
+PASS o18.property is undefined
+PASS o18.value is "JavaScriptCore!"
+PASS o18.__lookupGetter__('property') is undefined
+PASS o18.__lookupSetter__('property') is setter18
 PASS successfullyParsed is true
 

trunk/LayoutTests/js/script-tests/property-getters-and-setters.js

@@ -124 +124 @@
 shouldThrow("o16.__defineSetter__('b', function(){})");
 shouldThrow("o16.__defineSetter__('b', function(){})");
+
+debug("__lookupGetter__ can be interrupted by a proxy throwing an exception");
+var getter17 = () => { return "WebKit!"}
+var o17 = Object.defineProperty(new Object, 'property', { get: getter17 });
+shouldBeEqualToString("o17.property", "WebKit!");
+shouldBe("o17.__lookupGetter__('property')", "getter17");
+shouldBe("o17.__lookupSetter__('property')", "undefined");
+
+var o17Exception = { toString: () => { return "o17 Proxy raised exception"; } };
+var o17Proxy = new Proxy(o17, { getOwnPropertyDescriptor: () => { throw o17Exception; } });
+shouldThrow("o17Proxy.__lookupGetter__('property')", o17Exception);
+shouldThrow("o17Proxy.__lookupSetter__('property')", o17Exception);
+shouldBeEqualToString("o17Proxy.property", "WebKit!");
+shouldBeEqualToString("o17.property", "WebKit!");
+shouldBe("o17.__lookupGetter__('property')", "getter17");
+
+debug("__lookupSetter__ can be interrupted by a proxy throwing an exception");
+var setter18 = function (newValue) { return this.value = newValue; }
+var o18 = Object.defineProperty(new Object, 'property', { set: setter18 });
+shouldBe("o18.property = 5", "5");
+shouldBe("o18.property", "undefined");
+shouldBe("o18.value", "5");
+shouldBe("o18.__lookupGetter__('property')", "undefined");
+shouldBe("o18.__lookupSetter__('property')", "setter18");
+
+var o18Exception = { toString: () => { return "o18 Proxy raised exception"; } };
+var o18Proxy = new Proxy(o18, { getOwnPropertyDescriptor: () => { throw o18Exception; } });
+shouldThrow("o18Proxy.__lookupGetter__('property')", o18Exception);
+shouldThrow("o18Proxy.__lookupSetter__('property')", o18Exception);
+shouldThrow("o18Proxy.property = 'JavaScriptCore!'", o18Exception);
+shouldBe("o18Proxy.property", "undefined");
+shouldBe("o18Proxy.value", "5");
+shouldBeEqualToString("o18.property = 'JavaScriptCore!'", "JavaScriptCore!");
+shouldBe("o18.property", "undefined");
+shouldBeEqualToString("o18.value", "JavaScriptCore!");
+shouldBe("o18.__lookupGetter__('property')", "undefined");
+shouldBe("o18.__lookupSetter__('property')", "setter18");

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-07-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] __lookupGetter__ and __lookupSetter__ should not ignore exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=159390
+
+        Reviewed by Mark Lam.
+
+        See:
+        -https://tc39.github.io/ecma262/#sec-object.prototype.__lookupGetter__
+        -https://tc39.github.io/ecma262/#sec-object.prototype.__lookupSetter__
+
+        They are both supposed to be regular [[GetOwnProperty]].
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
 2016-07-03  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp

@@ -188 +188 @@
         return JSValue::encode(jsUndefined());
 
-    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
     if (thisObject->getPropertySlot(exec, propertyName, slot)) {
         if (slot.isAccessor()) {
@@ -215 +215 @@
         return JSValue::encode(jsUndefined());
 
-    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
     if (thisObject->getPropertySlot(exec, propertyName, slot)) {
         if (slot.isAccessor()) {