Changeset 248880 in webkit

Timestamp:

Aug 19, 2019 5:56:08 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Proxy constructor should throw if handler is revoked Proxy
​https://bugs.webkit.org/show_bug.cgi?id=198755

Patch by Alexey Shvayka <Alexey Shvayka> on 2019-08-19
Reviewed by Saam Barati.

JSTests:

• stress/proxy-revoke.js: Adjust error message.
• test262/expectations.yaml: Mark 2 test cases as passing.

Source/JavaScriptCore:

Reword error message and check if handler is revoked Proxy.
(step 4 of ​https://tc39.es/ecma262/#sec-proxycreate)

• runtime/ProxyObject.cpp:

(JSC::ProxyObject::finishCreation): Add isRevoked check.

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/proxy-revoke.js (modified) (1 diff)
• JSTests/test262/expectations.yaml (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ProxyObject.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        Proxy constructor should throw if handler is revoked Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=198755
+
+        Reviewed by Saam Barati.
+
+        * stress/proxy-revoke.js: Adjust error message.
+        * test262/expectations.yaml: Mark 2 test cases as passing.
+
 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/JSTests/stress/proxy-revoke.js

@@ -96 +96 @@
             } catch(e) {
                 threw = true;
-                assert(e.toString() === "TypeError: If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked");
+                assert(e.toString() === "TypeError: A Proxy's 'target' shouldn't be a revoked Proxy");
             }
             assert(threw);

trunk/JSTests/test262/expectations.yaml

@@ -1322 +1322 @@
   default: 'Test262Error: Expected a TypeError but got a TypeError'
   strict mode: 'Test262Error: Expected a TypeError but got a TypeError'
-test/built-ins/Proxy/create-handler-is-revoked-proxy.js:
-  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
-  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
 test/built-ins/RegExp/named-groups/groups-object-subclass-sans.js:
   default: 'Test262Error: Expected SameValue(«b», «$<a>») to be true'

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        Proxy constructor should throw if handler is revoked Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=198755
+
+        Reviewed by Saam Barati.
+
+        Reword error message and check if handler is revoked Proxy.
+        (step 4 of https://tc39.es/ecma262/#sec-proxycreate)
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation): Add isRevoked check.
+
 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp

@@ -92 +92 @@
     }
     if (ProxyObject* targetAsProxy = jsDynamicCast<ProxyObject*>(vm, target)) {
-        if (targetAsProxy->handler().isNull()) {
-            throwTypeError(exec, scope, "If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked"_s);
+        if (targetAsProxy->isRevoked()) {
+            throwTypeError(exec, scope, "A Proxy's 'target' shouldn't be a revoked Proxy"_s);
             return;
         }
@@ -100 +100 @@
         throwTypeError(exec, scope, "A Proxy's 'handler' should be an Object"_s);
         return;
+    }
+    if (ProxyObject* handlerAsProxy = jsDynamicCast<ProxyObject*>(vm, handler)) {
+        if (handlerAsProxy->isRevoked()) {
+            throwTypeError(exec, scope, "A Proxy's 'handler' shouldn't be a revoked Proxy"_s);
+            return;
+        }
     }