Changeset 245675 in webkit


Ignore:
Timestamp:
May 23, 2019 12:06:20 AM (5 years ago)
Author:
Tadeu Zagallo
Message:

createListFromArrayLike should throw if value is not an object
​https://bugs.webkit.org/show_bug.cgi?id=198138

Reviewed by Yusuke Suzuki.

JSTests:

  • stress/create-list-from-array-like-not-object.js: Added.

(testValid):
(testInvalid):

  • stress/proxy-get-own-property-names-should-not-clear-previous-results.js:

(opt):

  • stress/proxy-proto-enumerator.js: Added.

(main):

  • stress/proxy-proto-own-keys.js: Added.

(assert):
(ownKeys):

Source/JavaScriptCore:

According to the spec[1], createListFromArrayLike should throw a type error if the array-like value
passed in is not an object.
[1]: ​https://www.ecma-international.org/ecma-262/9.0/index.html#sec-createlistfromarraylike

  • runtime/JSObjectInlines.h:

(JSC::createListFromArrayLike):

  • runtime/ProxyObject.cpp:

(JSC::ProxyObject::performGetOwnPropertyNames):

  • runtime/ReflectObject.cpp:

(JSC::reflectObjectConstruct):

Location:
trunk
Files:
3 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r245667 r245675  
     12019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
     2
     3        createListFromArrayLike should throw if value is not an object
     4        https://bugs.webkit.org/show_bug.cgi?id=198138
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        * stress/create-list-from-array-like-not-object.js: Added.
     9        (testValid):
     10        (testInvalid):
     11        * stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
     12        (opt):
     13        * stress/proxy-proto-enumerator.js: Added.
     14        (main):
     15        * stress/proxy-proto-own-keys.js: Added.
     16        (assert):
     17        (ownKeys):
     18
    1192019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
    220

  • trunk/JSTests/stress/proxy-get-own-property-names-should-not-clear-previous-results.js

    r245643 r245675  
    77function opt() {
    88    a.__proto__ = new Proxy(Object,{ownKeys:opt});
    9     return 1;
     9    return [];
    1010}
    1111for(var i=0;i<400;i=i+1) {

  • trunk/Source/JavaScriptCore/ChangeLog

    r245669 r245675  
     12019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
     2
     3        createListFromArrayLike should throw if value is not an object
     4        https://bugs.webkit.org/show_bug.cgi?id=198138
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        According to the spec[1], createListFromArrayLike should throw a type error if the array-like value
     9        passed in is not an object.
     10        [1]: https://www.ecma-international.org/ecma-262/9.0/index.html#sec-createlistfromarraylike
     11
     12        * runtime/JSObjectInlines.h:
     13        (JSC::createListFromArrayLike):
     14        * runtime/ProxyObject.cpp:
     15        (JSC::ProxyObject::performGetOwnPropertyNames):
     16        * runtime/ReflectObject.cpp:
     17        (JSC::reflectObjectConstruct):
     18
    1192019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
    220

  • trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h

    r240951 r245675  
    3434// Section 7.3.17 of the spec.
    3535template <typename AddFunction> // Add function should have a type like: (JSValue, RuntimeType) -> bool
    36 void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String& errorMessage, AddFunction addFunction)
     36void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String& notAnObjectErroMessage, const String& illegalTypeErrorMessage, AddFunction addFunction)
    3737{
    3838    VM& vm = exec->vm();
    3939    auto scope = DECLARE_THROW_SCOPE(vm);
     40
     41    if (!arrayLikeValue.isObject()) {
     42        throwTypeError(exec, scope, notAnObjectErroMessage);
     43        return;
     44    }
    4045   
    4146    Vector<JSValue> result;
    … …  
    5257        RuntimeType type = runtimeTypeForValue(vm, next);
    5358        if (!(type & legalTypesFilter)) {
    54             throwTypeError(exec, scope, errorMessage);
     59            throwTypeError(exec, scope, illegalTypeErrorMessage);
    5560            return;
    5661        }

  • trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp

    r245643 r245675  
    975975
    976976        RuntimeTypeMask dontThrowAnExceptionTypeFilter = TypeString | TypeSymbol;
    977         createListFromArrayLike(exec, arrayLikeObject, dontThrowAnExceptionTypeFilter, "Proxy handler's 'ownKeys' method must return an array-like object containing only Strings and Symbols"_s, addPropName);
     977        createListFromArrayLike(exec, arrayLikeObject, dontThrowAnExceptionTypeFilter, "Proxy handler's 'ownKeys' method must return an object"_s, "Proxy handler's 'ownKeys' method must return an array-like object containing only Strings and Symbols"_s, addPropName);
    978978        RETURN_IF_EXCEPTION(scope, void());
    979979    }

  • trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp

    r242382 r245675  
    114114        return JSValue::encode(throwTypeError(exec, scope, "Reflect.construct requires the second argument be an object"_s));
    115115
    116     createListFromArrayLike(exec, argumentsObject, RuntimeTypeMaskAllTypes, "This error must not be raised"_s, [&] (JSValue value, RuntimeType) -> bool {
     116    createListFromArrayLike(exec, argumentsObject, RuntimeTypeMaskAllTypes, "This error must not be raised"_s, "This error must not be raised"_s, [&] (JSValue value, RuntimeType) -> bool {
    117117        arguments.append(value);
    118118        return false;
Note: See TracChangeset for help on using the changeset viewer.