Changeset 254757 in webkit

Timestamp:

Jan 17, 2020 12:21:57 PM (4 years ago)

Author:

Alexey Shvayka

Message:

JSON.parse should lookup prototype chains during revival
​https://bugs.webkit.org/show_bug.cgi?id=205769

Reviewed by Saam Barati.

JSTests:

• test262/expectations.yaml: Mark 4 test cases as passing.

Source/JavaScriptCore:

This patch makes JSON.parse use Get? instead of GetOwnProperty? during revival,
aligning JSC with the spec (step 1 of ​https://tc39.es/ecma262/#sec-internalizejsonproperty),
SpiderMonkey, and V8.

User-provided reviver can delete properties that are not yet inspected by itself,
making usage GetOwnProperty? non-compliant to the spec.

• runtime/JSONObject.cpp:

(JSC::Walker::walk):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/test262/expectations.yaml (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSONObject.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-01-17  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        JSON.parse should lookup prototype chains during revival
+        https://bugs.webkit.org/show_bug.cgi?id=205769
+
+        Reviewed by Saam Barati.
+
+        * test262/expectations.yaml: Mark 4 test cases as passing.
+
 2020-01-16  Robin Morisset  <rmorisset@apple.com>
 

trunk/JSTests/test262/expectations.yaml

@@ -1120 +1120 @@
   default: 'Test262Error: Expected SameValue(«[object GeneratorFunction]», «[object GeneratorFunction]») to be true'
   strict mode: 'Test262Error: Expected SameValue(«[object GeneratorFunction]», «[object GeneratorFunction]») to be true'
-test/built-ins/JSON/parse/reviver-array-get-prop-from-prototype.js:
-  default: 'Test262Error: Expected true but got false'
-  strict mode: 'Test262Error: Expected true but got false'
 test/built-ins/JSON/parse/reviver-array-non-configurable-prop-create.js:
   default: 'Test262Error: Expected SameValue(«22», «2») to be true'
   strict mode: 'Test262Error: Expected SameValue(«22», «2») to be true'
-test/built-ins/JSON/parse/reviver-object-get-prop-from-prototype.js:
-  default: 'Test262Error: Expected true but got false'
-  strict mode: 'Test262Error: Expected true but got false'
 test/built-ins/JSON/parse/reviver-object-non-configurable-prop-create.js:
   default: 'Test262Error: Expected SameValue(«22», «2») to be true'

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-01-17  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        JSON.parse should lookup prototype chains during revival
+        https://bugs.webkit.org/show_bug.cgi?id=205769
+
+        Reviewed by Saam Barati.
+
+        This patch makes JSON.parse use [[Get]] instead of [[GetOwnProperty]] during revival,
+        aligning JSC with the spec (step 1 of https://tc39.es/ecma262/#sec-internalizejsonproperty),
+        SpiderMonkey, and V8.
+
+        User-provided `reviver` can delete properties that are not yet inspected by itself,
+        making usage [[GetOwnProperty]] non-compliant to the spec.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+
 2020-01-17  Caio Lima  <ticaiolima@gmail.com>
 

trunk/Source/JavaScriptCore/runtime/JSONObject.cpp

@@ -693 +693 @@
                     inValue = array->getIndexQuickly(index);
                 else {
-                    PropertySlot slot(array, PropertySlot::InternalMethodType::Get);
-                    if (array->methodTable(vm)->getOwnPropertySlotByIndex(array, m_globalObject, index, slot))
-                        inValue = slot.getValue(m_globalObject, index);
-                    else
-                        inValue = jsUndefined();
+                    inValue = array->get(m_globalObject, index);
                     RETURN_IF_EXCEPTION(scope, { });
                 }
-                    
+
                 if (inValue.isObject()) {
                     stateStack.append(ArrayEndVisitMember);
@@ -747 +743 @@
                     break;
                 }
-                PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
-                if (object->methodTable(vm)->getOwnPropertySlot(object, m_globalObject, properties[index], slot))
-                    inValue = slot.getValue(m_globalObject, properties[index]);
-                else
-                    inValue = jsUndefined();
-
+                inValue = object->get(m_globalObject, properties[index]);
                 // The holder may be modified by the reviver function so any lookup may throw
                 RETURN_IF_EXCEPTION(scope, { });