Changeset 207618 in webkit

Timestamp:

Oct 20, 2016 8:00:43 AM (8 years ago)

Author:

caitp@igalia.com

Message:

[JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
​https://bugs.webkit.org/show_bug.cgi?id=163714

Reviewed by Mark Lam.

JSTests:

Add missing test coverage that dynamically created
JSGeneratorFunctions can not be constructed.

• stress/generator-function-constructor.js:

(shouldThrow):

Source/JavaScriptCore:

According to CreateDynamicFunction() (​https://tc39.github.io/ecma262/#sec-createdynamicfunction),
non-normal functions are not constructors. Previously, dynamically created functions would always
be constructible, and so it was possible to evaluate new (function*() {}.constructor()),
and have it return an Iterator object.

This change selects a dynamically created function's ConstructAbility based on its parse mode instead.

• runtime/CodeCache.cpp:

(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/generator-function-constructor.js (modified) (2 diffs)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/CodeCache.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-10-20  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
+        https://bugs.webkit.org/show_bug.cgi?id=163714
+
+        Reviewed by Mark Lam.
+
+        Add missing test coverage that dynamically created
+        JSGeneratorFunctions can not be constructed.
+
+        * stress/generator-function-constructor.js:
+        (shouldThrow):
+
 2016-10-19  JF Bastien  <jfbastien@apple.com>
 

trunk/JSTests/stress/generator-function-constructor.js

@@ -3 +3 @@
         throw new Error('bad value: ' + actual);
 }
+
+function shouldThrow(func, errorMessage) {
+    var errorThrown = false;
+    var error = null;
+    try {
+        func();
+    } catch (e) {
+        errorThrown = true;
+        error = e;
+    }
+    if (!errorThrown)
+        throw new Error('not thrown');
+    if (String(error) !== errorMessage)
+        throw new Error(`bad error: ${String(error)}`);
+}
+
 var global = (new Function("return this"))();
 shouldBe(typeof global.GeneratorFunction, 'undefined');
@@ -11 +27 @@
 shouldBe(generatorFunctionConstructor("a") instanceof generatorFunctionConstructor, true);
 shouldBe(generatorFunctionConstructor("a", "b") instanceof generatorFunctionConstructor, true);
+
+// Generator functions created by the GeneratorFunction constructor are not themselves constructors.
+shouldThrow(() => new (generatorFunctionConstructor()), "TypeError: function is not a constructor (evaluating 'new (generatorFunctionConstructor())')");

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-20  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
+        https://bugs.webkit.org/show_bug.cgi?id=163714
+
+        Reviewed by Mark Lam.
+
+        According to CreateDynamicFunction() (https://tc39.github.io/ecma262/#sec-createdynamicfunction),
+        non-normal functions are not constructors. Previously, dynamically created functions would always
+        be constructible, and so it was possible to evaluate `new  (function*() {}.constructor())`,
+        and have it return an Iterator object.
+
+        This change selects a dynamically created function's ConstructAbility based on its parse mode instead.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+
 2016-10-19  JF Bastien  <jfbastien@apple.com>
 

trunk/Source/JavaScriptCore/runtime/CodeCache.cpp

@@ -203 +203 @@
     // The Function constructor only has access to global variables, so no variables will be under TDZ.
     VariableEnvironment emptyTDZVariables;
-    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, metadata, UnlinkedNormalFunction, ConstructAbility::CanConstruct, JSParserScriptMode::Classic, emptyTDZVariables, DerivedContextType::None);
+    ConstructAbility constructAbility = constructAbilityForParseMode(metadata->parseMode());
+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, metadata, UnlinkedNormalFunction, constructAbility, JSParserScriptMode::Classic, emptyTDZVariables, DerivedContextType::None);
 
     functionExecutable->setSourceURLDirective(source.provider()->sourceURL());