Changeset 260732 in webkit


Ignore:
Timestamp:
Apr 26, 2020 2:30:38 PM (4 years ago)
Author:
Alexey Shvayka
Message:

InternalFunction::createSubclassStructure should use newTarget's globalObject
​https://bugs.webkit.org/show_bug.cgi?id=202599

Reviewed by Yusuke Suzuki.

JSTests:

  • stress/promise-proto-from-ctor-realm.js: Added.
  • test262/expectations.yaml: Mark 88 test cases as passing.

LayoutTests/imported/w3c:

  • web-platform-tests/WebIDL/ecmascript-binding/constructors-expected.txt:
  • web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt:
  • web-platform-tests/wasm/jsapi/proto-from-ctor-realm-expected.txt:

Source/JavaScriptCore:

If "prototype" of NewTarget is not an object, built-in constructors [1] should acquire
default Prototype? from realm of NewTarget, utilizing GetFunctionRealm helper [2].
Before this change, realm of active constructor was used instead. This patch introduces
GetFunctionRealm and aligns all subclassable constructors with the spec, V8, and SpiderMonkey.

This change inlines fast paths checks of InternalFunction::createSubclassStructure() and
simplifies its signature; getFunctionRealm() is invoked in slow paths only.

While a dynamically created function uses NewTarget's realm for its default Prototype?
similar to other built-ins, its "prototype" object inherit from ObjectPrototype
of active constructor's realm [3] (just like their scope), making it retain references
to 2 different global objects. To accomodate this behavior, this change introduces
scopeGlobalObject in JSFunction.cpp methods.

Above-mentioned behavior also simplifies creation of JSGenerator and JSAsyncGenerator
instances since NewTarget's realm is irrelevant to them.

IntlCollatorConstructor::collatorStructure() and 6 similar methods are removed:
a) to impose good practice of using newTarget's globalObject;
b) with this change, each of them have 1 call site max;
c) other JSC constructors have no methods alike.

[1]: ​https://tc39.es/ecma262/#sec-map-constructor (step 2)
[2]: ​https://tc39.es/ecma262/#sec-getfunctionrealm
[3]: ​https://tc39.es/ecma262/#sec-createdynamicfunction (steps 23-25)

  • dfg/DFGOperations.cpp:
  • runtime/AggregateErrorConstructor.cpp:

(JSC::callAggregateErrorConstructor):
(JSC::constructAggregateErrorConstructor):

  • runtime/AggregateErrorConstructor.h:
  • runtime/AsyncFunctionConstructor.cpp:

(JSC::constructAsyncFunctionConstructor):

  • runtime/AsyncGeneratorFunctionConstructor.cpp:

(JSC::constructAsyncGeneratorFunctionConstructor):

  • runtime/BooleanConstructor.cpp:

(JSC::constructWithBooleanConstructor):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):
(JSC::createInternalFieldObject):

  • runtime/DateConstructor.cpp:

(JSC::constructDate):

  • runtime/ErrorConstructor.cpp:

(JSC::constructErrorConstructor):

  • runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

  • runtime/InternalFunction.cpp:

(JSC::InternalFunction::createSubclassStructure):
(JSC::getFunctionRealm):
(JSC::InternalFunction::createSubclassStructureSlow): Deleted.

  • runtime/InternalFunction.h:

(JSC::InternalFunction::createSubclassStructure): Deleted.

  • runtime/IntlCollatorConstructor.cpp:

(JSC::constructIntlCollator):
(JSC::callIntlCollator):

  • runtime/IntlCollatorConstructor.h:
  • runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::constructIntlDateTimeFormat):
(JSC::callIntlDateTimeFormat):

  • runtime/IntlDateTimeFormatConstructor.h:
  • runtime/IntlNumberFormatConstructor.cpp:

(JSC::constructIntlNumberFormat):
(JSC::callIntlNumberFormat):

  • runtime/IntlNumberFormatConstructor.h:
  • runtime/IntlPluralRulesConstructor.cpp:

(JSC::constructIntlPluralRules):

  • runtime/IntlPluralRulesConstructor.h:
  • runtime/IntlRelativeTimeFormatConstructor.cpp:

(JSC::constructIntlRelativeTimeFormat):

  • runtime/IntlRelativeTimeFormatConstructor.h:
  • runtime/JSArrayBufferConstructor.cpp:

(JSC::JSGenericArrayBufferConstructor<sharingMode>::constructArrayBuffer):

  • runtime/JSFunction.cpp:

(JSC::JSFunction::prototypeForConstruction):
(JSC::JSFunction::getOwnPropertySlot):

  • runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayView):

  • runtime/JSGlobalObjectInlines.h:

(JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation const):

  • runtime/MapConstructor.cpp:

(JSC::constructMap):

  • runtime/NativeErrorConstructor.cpp:

(JSC::NativeErrorConstructor<errorType>::constructNativeErrorConstructor):
(JSC::NativeErrorConstructor<errorType>::callNativeErrorConstructor):

  • runtime/NativeErrorConstructor.h:
  • runtime/NumberConstructor.cpp:

(JSC::constructNumberConstructor):

  • runtime/ObjectConstructor.cpp:

(JSC::constructObjectWithNewTarget):

  • runtime/RegExpConstructor.cpp:

(JSC::getRegExpStructure):
(JSC::constructRegExp):
(JSC::esSpecRegExpCreate):

  • runtime/RegExpConstructor.h:
  • runtime/SetConstructor.cpp:

(JSC::constructSet):

  • runtime/StringConstructor.cpp:

(JSC::constructWithStringConstructor):

  • runtime/WeakMapConstructor.cpp:

(JSC::constructWeakMap):

  • runtime/WeakObjectRefConstructor.cpp:

(JSC::constructWeakRef):

  • runtime/WeakSetConstructor.cpp:

(JSC::constructWeakSet):

  • wasm/js/WebAssemblyCompileErrorConstructor.cpp:

(JSC::constructJSWebAssemblyCompileError):

  • wasm/js/WebAssemblyInstanceConstructor.cpp:

(JSC::constructJSWebAssemblyInstance):

  • wasm/js/WebAssemblyLinkErrorConstructor.cpp:

(JSC::constructJSWebAssemblyLinkError):

  • wasm/js/WebAssemblyModuleConstructor.cpp:

(JSC::WebAssemblyModuleConstructor::createModule):

  • wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:

(JSC::constructJSWebAssemblyRuntimeError):

Source/WebCore:

Accounts for InternalFunction::createSubclassStructure() signature change and
utilizes getFunctionRealm() helper to handle cross-realm JSBoundFunction and
ProxyObject instances as NewTarget value.

Tests: web-platform-tests/WebIDL/ecmascript-binding/constructors.html

web-platform-tests/custom-elements/htmlconstructor/newtarget.html

  • bindings/js/JSDOMWrapperCache.h:

(WebCore::setSubclassStructureIfNeeded):

  • bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement):

Location:
trunk
Files:
1 added
53 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r260730 r260732  
     12020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        InternalFunction::createSubclassStructure should use newTarget's globalObject
     4        https://bugs.webkit.org/show_bug.cgi?id=202599
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        * stress/promise-proto-from-ctor-realm.js: Added.
     9        * test262/expectations.yaml: Mark 88 test cases as passing.
     10
    1112020-04-26  Yusuke Suzuki  <ysuzuki@apple.com>
    212

  • trunk/JSTests/test262/expectations.yaml

    r260697 r260732  
    634634  default: 'Test262Error: Expected SameValue(«undefined», «[object Function]») to be true'
    635635  strict mode: 'Test262Error: Expected SameValue(«undefined», «[object Function]») to be true'
    636 test/built-ins/Array/proto-from-ctor-realm-one.js:
    637   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«», «») to be true'
    638   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«», «») to be true'
    639 test/built-ins/Array/proto-from-ctor-realm-two.js:
    640   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«», «») to be true'
    641   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«», «») to be true'
    642 test/built-ins/Array/proto-from-ctor-realm-zero.js:
    643   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«», «») to be true'
    644   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«», «») to be true'
    645636test/built-ins/Array/prototype/concat/arg-length-exceeding-integer-limit.js:
    646637  default: 'Test262Error: Expected a TypeError but got a RangeError'
    … …  
    709700  default: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'
    710701  strict mode: 'Test262Error: Length is 2**53 - 1 Expected SameValue(«4294967295», «9007199254740991») to be true'
    711 test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
    712   default: 'Test262Error: Expected SameValue(«[object ArrayBuffer]», «[object ArrayBuffer]») to be true'
    713   strict mode: 'Test262Error: Expected SameValue(«[object ArrayBuffer]», «[object ArrayBuffer]») to be true'
    714702test/built-ins/ArrayBuffer/prototype/byteLength/detached-buffer.js:
    715703  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    … …  
    748736  default: 'Test262:AsyncTestFailure:Test262Error: Test262Error: Expected SameValue(«1», «0») to be true'
    749737  strict mode: 'Test262:AsyncTestFailure:Test262Error: Test262Error: Expected SameValue(«1», «0») to be true'
    750 test/built-ins/AsyncFunction/proto-from-ctor-realm.js:
    751   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object AsyncFunction]», «[object AsyncFunction]») to be true'
    752   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object AsyncFunction]», «[object AsyncFunction]») to be true'
    753 test/built-ins/AsyncGeneratorFunction/proto-from-ctor-realm.js:
    754   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object AsyncGeneratorFunction]», «[object AsyncGeneratorFunction]») to be true'
    755   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object AsyncGeneratorFunction]», «[object AsyncGeneratorFunction]») to be true'
    756738test/built-ins/AsyncGeneratorPrototype/return/return-suspendedYield-promise.js:
    757739  default: 'Test262:AsyncTestFailure:Test262Error: Test262Error: AsyncGeneratorResolve(generator, resultValue, true) Expected SameValue(«[object Promise]», «unwrapped-value») to be true'
    … …  
    817799  default: 'Test262Error: Expected SameValue(«0», «2») to be true'
    818800  strict mode: 'Test262Error: Expected SameValue(«0», «2») to be true'
    819 test/built-ins/Boolean/proto-from-ctor-realm.js:
    820   default: 'Test262Error: Expected SameValue(«false», «false») to be true'
    821   strict mode: 'Test262Error: Expected SameValue(«false», «false») to be true'
    822801test/built-ins/DataView/custom-proto-access-detaches-buffer.js:
    823802  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    … …  
    829808  default: 'Test262Error: descriptor value should be 1'
    830809  strict mode: 'Test262Error: descriptor value should be 1'
    831 test/built-ins/DataView/proto-from-ctor-realm.js:
    832   default: 'Test262Error: Expected SameValue(«[object DataView]», «[object DataView]») to be true'
    833   strict mode: 'Test262Error: Expected SameValue(«[object DataView]», «[object DataView]») to be true'
    834810test/built-ins/DataView/prototype/byteLength/detached-buffer.js:
    835811  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all'
    … …  
    934910  default: 'Test262Error: Expected a TypeError but got a RangeError'
    935911  strict mode: 'Test262Error: Expected a TypeError but got a RangeError'
    936 test/built-ins/Date/proto-from-ctor-realm-one.js:
    937   default: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    938   strict mode: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    939 test/built-ins/Date/proto-from-ctor-realm-two.js:
    940   default: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    941   strict mode: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    942 test/built-ins/Date/proto-from-ctor-realm-zero.js:
    943   default: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    944   strict mode: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    945 test/built-ins/Error/proto-from-ctor-realm.js:
    946   default: 'Test262Error: Expected SameValue(«Error», «Error») to be true'
    947   strict mode: 'Test262Error: Expected SameValue(«Error», «Error») to be true'
    948912test/built-ins/Function/call-bind-this-realm-undef.js:
    949913  default: 'Test262Error: implicit undefined Expected SameValue(«[object global]», «[object Undefined]») to be true'
    … …  
    964928  default: 'Test262Error: Expected a ReferenceError but got a ReferenceError'
    965929  strict mode: 'Test262Error: Expected a ReferenceError but got a ReferenceError'
    966 test/built-ins/Function/proto-from-ctor-realm.js:
    967   default: 'Test262Error: Expected SameValue(«function () {'
    968   strict mode: 'Test262Error: Expected SameValue(«function () {'
    969 test/built-ins/Function/prototype/bind/get-fn-realm-recursive.js:
    970   default: 'Test262Error: Expected true but got false'
    971   strict mode: 'Test262Error: Expected true but got false'
    972 test/built-ins/Function/prototype/bind/get-fn-realm.js:
    973   default: 'Test262Error: Expected true but got false'
    974   strict mode: 'Test262Error: Expected true but got false'
    975930test/built-ins/Function/prototype/bind/length-exceeds-int32.js:
    976931  default: 'Test262Error: Expected SameValue(«0», «2147483648») to be true'
    … …  
    11111066  default: "Test262Error: Conforms to NativeFunction Syntax: 'function a(\\u{62}, \\u0063) { \\u0062 = \\u{00063}; return b; }'.(function \\u0061(\\u{62}, \\u0063) { \\u0062 = \\u{00063}; return b; })"
    11121067  strict mode: "Test262Error: Conforms to NativeFunction Syntax: 'function a(\\u{62}, \\u0063) { \\u0062 = \\u{00063}; return b; }'.(function \\u0061(\\u{62}, \\u0063) { \\u0062 = \\u{00063}; return b; })"
    1113 test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
    1114   default: 'Test262Error: Expected SameValue(«[object GeneratorFunction]», «[object GeneratorFunction]») to be true'
    1115   strict mode: 'Test262Error: Expected SameValue(«[object GeneratorFunction]», «[object GeneratorFunction]») to be true'
    11161068test/built-ins/JSON/parse/reviver-object-non-configurable-prop-create.js:
    11171069  default: 'Test262Error: Expected SameValue(«22», «2») to be true'
    11181070  strict mode: 'Test262Error: Expected SameValue(«22», «2») to be true'
    1119 test/built-ins/Map/proto-from-ctor-realm.js:
    1120   default: 'Test262Error: Expected SameValue(«[object Map]», «[object Map]») to be true'
    1121   strict mode: 'Test262Error: Expected SameValue(«[object Map]», «[object Map]») to be true'
    1122 test/built-ins/NativeErrors/EvalError/proto-from-ctor-realm.js:
    1123   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«EvalError», «EvalError») to be true'
    1124   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«EvalError», «EvalError») to be true'
    1125 test/built-ins/NativeErrors/RangeError/proto-from-ctor-realm.js:
    1126   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«RangeError», «RangeError») to be true'
    1127   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«RangeError», «RangeError») to be true'
    1128 test/built-ins/NativeErrors/ReferenceError/proto-from-ctor-realm.js:
    1129   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«ReferenceError», «ReferenceError») to be true'
    1130   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«ReferenceError», «ReferenceError») to be true'
    1131 test/built-ins/NativeErrors/SyntaxError/proto-from-ctor-realm.js:
    1132   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«SyntaxError», «SyntaxError») to be true'
    1133   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«SyntaxError», «SyntaxError») to be true'
    1134 test/built-ins/NativeErrors/TypeError/proto-from-ctor-realm.js:
    1135   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«TypeError», «TypeError») to be true'
    1136   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«TypeError», «TypeError») to be true'
    1137 test/built-ins/NativeErrors/URIError/proto-from-ctor-realm.js:
    1138   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«URIError», «URIError») to be true'
    1139   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«URIError», «URIError») to be true'
    11401071test/built-ins/Number/bigint-conversion.js:
    11411072  default: "TypeError: Conversion from 'BigInt' to 'number' is not allowed."
    11421073  strict mode: "TypeError: Conversion from 'BigInt' to 'number' is not allowed."
    1143 test/built-ins/Number/proto-from-ctor-realm.js:
    1144   default: 'Test262Error: Expected SameValue(«0», «0») to be true'
    1145   strict mode: 'Test262Error: Expected SameValue(«0», «0») to be true'
    11461074test/built-ins/Object/entries/order-after-define-property.js:
    11471075  default: 'Test262Error: Expected [b, a] and [a, b] to have the same contents. '
    … …  
    11661094  default: 'Test262Error: Expected [b, a] and [a, b] to have the same contents. '
    11671095  strict mode: 'Test262Error: Expected [b, a] and [a, b] to have the same contents. '
    1168 test/built-ins/Object/proto-from-ctor-realm.js:
    1169   default: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    1170   strict mode: 'Test262Error: Expected SameValue(«[object Object]», «[object Object]») to be true'
    11711096test/built-ins/Object/prototype/toString/proxy-function.js:
    11721097  default: 'Test262Error: function proxy Expected SameValue(«[object Object]», «[object Function]») to be true'
    … …  
    11991124  default: 'Test262Error: Expected SameValue(«true», «false») to be true'
    12001125  strict mode: 'Test262Error: Expected SameValue(«true», «false») to be true'
    1201 test/built-ins/Promise/proto-from-ctor-realm.js:
    1202   default: 'Test262Error: Expected SameValue(«[object Promise]», «[object Promise]») to be true'
    1203   strict mode: 'Test262Error: Expected SameValue(«[object Promise]», «[object Promise]») to be true'
    12041126test/built-ins/Promise/prototype/finally/invokes-then-with-function.js:
    12051127  default: 'Test262Error: fulfillment handler is not constructor'
    … …  
    12531175  default: 'Test262Error: Expected a TypeError but got a TypeError'
    12541176  strict mode: 'Test262Error: Expected a TypeError but got a TypeError'
    1255 test/built-ins/Proxy/get-fn-realm-recursive.js:
    1256   default: 'Test262Error: Expected true but got false'
    1257   strict mode: 'Test262Error: Expected true but got false'
    1258 test/built-ins/Proxy/get-fn-realm.js:
    1259   default: 'Test262Error: Expected true but got false'
    1260   strict mode: 'Test262Error: Expected true but got false'
    12611177test/built-ins/Proxy/ownKeys/trap-is-undefined-target-is-proxy.js:
    12621178  default: 'Test262Error: Expected [length, foo, 0, Symbol()] and [Symbol(), length, foo, 0] to have the same contents. '
    … …  
    16581574  default: 'Test262Error: `\p{XID_Start}` should match U+001CFA (`ᳺ`)'
    16591575  strict mode: 'Test262Error: `\p{XID_Start}` should match U+001CFA (`ᳺ`)'
    1660 test/built-ins/RegExp/proto-from-ctor-realm.js:
    1661   default: 'Test262Error: Expected SameValue(«/(?:)/», «/(?:)/») to be true'
    1662   strict mode: 'Test262Error: Expected SameValue(«/(?:)/», «/(?:)/») to be true'
    16631576test/built-ins/RegExp/prototype/Symbol.match/builtin-infer-unicode.js:
    16641577  default: 'Test262Error: Expected SameValue(«�», «null») to be true'
    … …  
    16971610  default: 'SyntaxError: Invalid regular expression: number too large in {} quantifier'
    16981611  strict mode: 'SyntaxError: Invalid regular expression: number too large in {} quantifier'
    1699 test/built-ins/Set/proto-from-ctor-realm.js:
    1700   default: 'Test262Error: Expected SameValue(«[object Set]», «[object Set]») to be true'
    1701   strict mode: 'Test262Error: Expected SameValue(«[object Set]», «[object Set]») to be true'
    1702 test/built-ins/String/proto-from-ctor-realm.js:
    1703   default: 'Test262Error: Expected SameValue(«», «») to be true'
    1704   strict mode: 'Test262Error: Expected SameValue(«», «») to be true'
    17051612test/built-ins/String/prototype/replace/cstm-replace-is-null.js:
    17061613  default: 'TypeError: null is not a function'
    … …  
    17771684  default: 'Test262Error: Expected a TypeError but got a RangeError (Testing with Float64Array.)'
    17781685  strict mode: 'Test262Error: Expected a TypeError but got a RangeError (Testing with Float64Array.)'
    1779 test/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm.js:
    1780   default: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1781   strict mode: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1782 test/built-ins/TypedArrayConstructors/ctors/length-arg/proto-from-ctor-realm.js:
    1783   default: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1784   strict mode: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1785 test/built-ins/TypedArrayConstructors/ctors/no-args/proto-from-ctor-realm.js:
    1786   default: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1787   strict mode: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    17881686test/built-ins/TypedArrayConstructors/ctors/object-arg/length-excessive-throws.js:
    17891687  default: 'Test262Error: Expected a RangeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    17901688  strict mode: 'Test262Error: Expected a RangeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1791 test/built-ins/TypedArrayConstructors/ctors/object-arg/proto-from-ctor-realm.js:
    1792   default: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1793   strict mode: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    17941689test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/detached-when-species-retrieved-different-type.js:
    17951690  default: 'Test262Error: TypeError thrown for detached source buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    … …  
    18191714  default: 'Test262Error: Expected a Test262Error to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    18201715  strict mode: 'Test262Error: Expected a Test262Error to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1821 test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/proto-from-ctor-realm.js:
    1822   default: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    1823   strict mode: 'Test262Error: Expected SameValue(«[object Float64ArrayPrototype]», «[object Float64ArrayPrototype]») to be true (Testing with Float64Array.)'
    18241716test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/same-ctor-buffer-ctor-access-throws.js:
    18251717  default: 'Test262Error: Expected a Test262Error to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    … …  
    19091801  default: 'TypeError: TypedArray.of requires its this argument to subclass a TypedArray constructor (Testing with Float64Array.)'
    19101802  strict mode: 'TypeError: TypedArray.of requires its this argument to subclass a TypedArray constructor (Testing with Float64Array.)'
    1911 test/built-ins/WeakMap/proto-from-ctor-realm.js:
    1912   default: 'Test262Error: Expected SameValue(«[object WeakMap]», «[object WeakMap]») to be true'
    1913   strict mode: 'Test262Error: Expected SameValue(«[object WeakMap]», «[object WeakMap]») to be true'
    1914 test/built-ins/WeakRef/proto-from-ctor-realm.js:
    1915   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object WeakRef]», «[object WeakRef]») to be true'
    1916   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object WeakRef]», «[object WeakRef]») to be true'
    1917 test/built-ins/WeakSet/proto-from-ctor-realm.js:
    1918   default: 'Test262Error: Expected SameValue(«[object WeakSet]», «[object WeakSet]») to be true'
    1919   strict mode: 'Test262Error: Expected SameValue(«[object WeakSet]», «[object WeakSet]») to be true'
    19201803test/intl402/Collator/missing-unicode-ext-value-defaults-to-true.js:
    19211804  default: "Test262Error: \"kn-true\" is returned in locale, but shouldn't be. Expected SameValue(«7», «-1») to be true"
    19221805  strict mode: "Test262Error: \"kn-true\" is returned in locale, but shouldn't be. Expected SameValue(«7», «-1») to be true"
    1923 test/intl402/Collator/proto-from-ctor-realm.js:
    1924   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    1925   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    19261806test/intl402/Collator/usage-de.js:
    19271807  default: 'Test262Error: Expected [Ä, AE] and [AE, Ä] to have the same contents. search'
    19281808  strict mode: 'Test262Error: Expected [Ä, AE] and [AE, Ä] to have the same contents. search'
    1929 test/intl402/DateTimeFormat/proto-from-ctor-realm.js:
    1930   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    1931   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    19321809test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-default.js:
    19331810  default: 'Test262Error: Expected SameValue(«h24», «h23») to be true'
    … …  
    19751852  default: 'Test262Error: Expected a RangeError to be thrown but no exception was thrown at all'
    19761853  strict mode: 'Test262Error: Expected a RangeError to be thrown but no exception was thrown at all'
    1977 test/intl402/NumberFormat/proto-from-ctor-realm.js:
    1978   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    1979   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    1980 test/intl402/PluralRules/proto-from-ctor-realm.js:
    1981   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    1982   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Object]», «[object Object]») to be true'
    19831854test/intl402/RelativeTimeFormat/constructor/constructor/locales-valid.js:
    19841855  default: 'Test262Error: Grandfathered Expected a RangeError to be thrown but no exception was thrown at all'
    19851856  strict mode: 'Test262Error: Grandfathered Expected a RangeError to be thrown but no exception was thrown at all'
    1986 test/intl402/RelativeTimeFormat/constructor/constructor/proto-from-ctor-realm.js:
    1987   default: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Intl.RelativeTimeFormat]», «[object Intl.RelativeTimeFormat]») to be true'
    1988   strict mode: 'Test262Error: newTarget.prototype is undefined Expected SameValue(«[object Intl.RelativeTimeFormat]», «[object Intl.RelativeTimeFormat]») to be true'
    19891857test/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js:
    19901858  default: 'Test262Error: Expected SameValue(«za 1000 sekund», «za 1 000 sekund») to be true'

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r260707 r260732  
     12020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        InternalFunction::createSubclassStructure should use newTarget's globalObject
     4        https://bugs.webkit.org/show_bug.cgi?id=202599
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        * web-platform-tests/WebIDL/ecmascript-binding/constructors-expected.txt:
     9        * web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt:
     10        * web-platform-tests/wasm/jsapi/proto-from-ctor-realm-expected.txt:
     11
    1122020-04-25  Darin Adler  <darin@apple.com>
    213

  • trunk/LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/constructors-expected.txt

    r256716 r260732  
    1111PASS Constructor in child window with bad NewTarget from parent window
    1212PASS Constructor in parent window with bad NewTarget from child window
    13 FAIL Constructor in parent window with bad NewTarget from parent window that's a bound child window function assert_equals: expected object "[object DOMParserPrototype]" but got object "[object DOMParserPrototype]"
    14 FAIL Constructor in child window with bad NewTarget from child window that's a bound parent window function assert_equals: expected object "[object DOMParserPrototype]" but got object "[object DOMParserPrototype]"
    15 FAIL Constructor in parent window with bad NewTarget from parent window that's a proxy for a child window function assert_equals: expected object "[object DOMParserPrototype]" but got object "[object DOMParserPrototype]"
    16 FAIL Constructor in child window with bad NewTarget from child window that's a proxy for a parent window function assert_equals: expected object "[object DOMParserPrototype]" but got object "[object DOMParserPrototype]"
     13PASS Constructor in parent window with bad NewTarget from parent window that's a bound child window function
     14PASS Constructor in child window with bad NewTarget from child window that's a bound parent window function
     15PASS Constructor in parent window with bad NewTarget from parent window that's a proxy for a child window function
     16PASS Constructor in child window with bad NewTarget from child window that's a proxy for a parent window function
    1717

  • trunk/LayoutTests/imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt

    r260670 r260732  
    33PASS Rethrow any exceptions thrown while getting the prototype
    44PASS If prototype is not object (null), derives the fallback from NewTarget's realm (autonomous custom elements)
    5 FAIL If prototype is not object (null), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
     5PASS If prototype is not object (null), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements)
    66PASS If prototype is not object (undefined), derives the fallback from NewTarget's realm (autonomous custom elements)
    7 FAIL If prototype is not object (undefined), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
     7PASS If prototype is not object (undefined), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements)
    88PASS If prototype is not object (5), derives the fallback from NewTarget's realm (autonomous custom elements)
    9 FAIL If prototype is not object (5), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
     9PASS If prototype is not object (5), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements)
    1010PASS If prototype is not object (string), derives the fallback from NewTarget's realm (autonomous custom elements)
    11 FAIL If prototype is not object (string), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements) assert_equals: Must use the HTMLElement from the realm of NewTarget expected object "[object HTMLElementPrototype]" but got object "[object HTMLElementPrototype]"
     11PASS If prototype is not object (string), derives the fallback from NewTarget's GetFunctionRealm (autonomous custom elements)
    1212FAIL If prototype is not object (null), derives the fallback from NewTarget's realm (customized built-in elements) promise_test: Unhandled rejection with value: object "TypeError: Reflect.construct requires the first argument be a constructor"
    1313FAIL If prototype is not object (null), derives the fallback from NewTarget's GetFunctionRealm (customized built-in elements) promise_test: Unhandled rejection with value: object "TypeError: Reflect.construct requires the first argument be a constructor"

  • trunk/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/proto-from-ctor-realm-expected.txt

    r260690 r260732  
    11
    2 FAIL WebAssembly.Module: cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    3 FAIL WebAssembly.Module: cross-realm NewTarget with `null` prototype assert_true: expected true got false
    4 FAIL WebAssembly.Module: cross-realm NewTarget with `false` prototype assert_true: expected true got false
    5 FAIL WebAssembly.Module: cross-realm NewTarget with `true` prototype assert_true: expected true got false
    6 FAIL WebAssembly.Module: cross-realm NewTarget with `0` prototype assert_true: expected true got false
    7 FAIL WebAssembly.Module: cross-realm NewTarget with `-1` prototype assert_true: expected true got false
    8 FAIL WebAssembly.Module: cross-realm NewTarget with `""` prototype assert_true: expected true got false
    9 FAIL WebAssembly.Module: cross-realm NewTarget with `"str"` prototype assert_true: expected true got false
    10 FAIL WebAssembly.Module: cross-realm NewTarget with `symbol "Symbol()"` prototype assert_true: expected true got false
    11 FAIL WebAssembly.Module: bound cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    12 FAIL WebAssembly.Module: bound bound cross-realm NewTarget with `null` prototype assert_true: expected true got false
    13 FAIL WebAssembly.Module: bound Proxy of cross-realm NewTarget with `false` prototype assert_true: expected true got false
    14 FAIL WebAssembly.Module: Proxy of cross-realm NewTarget with `true` prototype assert_true: expected true got false
    15 FAIL WebAssembly.Module: Proxy of Proxy of cross-realm NewTarget with `-0` prototype assert_true: expected true got false
    16 FAIL WebAssembly.Module: Proxy of bound cross-realm NewTarget with `NaN` prototype assert_true: expected true got false
    17 FAIL WebAssembly.Instance: cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    18 FAIL WebAssembly.Instance: cross-realm NewTarget with `null` prototype assert_true: expected true got false
    19 FAIL WebAssembly.Instance: cross-realm NewTarget with `false` prototype assert_true: expected true got false
    20 FAIL WebAssembly.Instance: cross-realm NewTarget with `true` prototype assert_true: expected true got false
    21 FAIL WebAssembly.Instance: cross-realm NewTarget with `0` prototype assert_true: expected true got false
    22 FAIL WebAssembly.Instance: cross-realm NewTarget with `-1` prototype assert_true: expected true got false
    23 FAIL WebAssembly.Instance: cross-realm NewTarget with `""` prototype assert_true: expected true got false
    24 FAIL WebAssembly.Instance: cross-realm NewTarget with `"str"` prototype assert_true: expected true got false
    25 FAIL WebAssembly.Instance: cross-realm NewTarget with `symbol "Symbol()"` prototype assert_true: expected true got false
    26 FAIL WebAssembly.Instance: bound cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    27 FAIL WebAssembly.Instance: bound bound cross-realm NewTarget with `null` prototype assert_true: expected true got false
    28 FAIL WebAssembly.Instance: bound Proxy of cross-realm NewTarget with `false` prototype assert_true: expected true got false
    29 FAIL WebAssembly.Instance: Proxy of cross-realm NewTarget with `true` prototype assert_true: expected true got false
    30 FAIL WebAssembly.Instance: Proxy of Proxy of cross-realm NewTarget with `-0` prototype assert_true: expected true got false
    31 FAIL WebAssembly.Instance: Proxy of bound cross-realm NewTarget with `NaN` prototype assert_true: expected true got false
     2PASS WebAssembly.Module: cross-realm NewTarget with `undefined` prototype
     3PASS WebAssembly.Module: cross-realm NewTarget with `null` prototype
     4PASS WebAssembly.Module: cross-realm NewTarget with `false` prototype
     5PASS WebAssembly.Module: cross-realm NewTarget with `true` prototype
     6PASS WebAssembly.Module: cross-realm NewTarget with `0` prototype
     7PASS WebAssembly.Module: cross-realm NewTarget with `-1` prototype
     8PASS WebAssembly.Module: cross-realm NewTarget with `""` prototype
     9PASS WebAssembly.Module: cross-realm NewTarget with `"str"` prototype
     10PASS WebAssembly.Module: cross-realm NewTarget with `symbol "Symbol()"` prototype
     11PASS WebAssembly.Module: bound cross-realm NewTarget with `undefined` prototype
     12PASS WebAssembly.Module: bound bound cross-realm NewTarget with `null` prototype
     13PASS WebAssembly.Module: bound Proxy of cross-realm NewTarget with `false` prototype
     14PASS WebAssembly.Module: Proxy of cross-realm NewTarget with `true` prototype
     15PASS WebAssembly.Module: Proxy of Proxy of cross-realm NewTarget with `-0` prototype
     16PASS WebAssembly.Module: Proxy of bound cross-realm NewTarget with `NaN` prototype
     17PASS WebAssembly.Instance: cross-realm NewTarget with `undefined` prototype
     18PASS WebAssembly.Instance: cross-realm NewTarget with `null` prototype
     19PASS WebAssembly.Instance: cross-realm NewTarget with `false` prototype
     20PASS WebAssembly.Instance: cross-realm NewTarget with `true` prototype
     21PASS WebAssembly.Instance: cross-realm NewTarget with `0` prototype
     22PASS WebAssembly.Instance: cross-realm NewTarget with `-1` prototype
     23PASS WebAssembly.Instance: cross-realm NewTarget with `""` prototype
     24PASS WebAssembly.Instance: cross-realm NewTarget with `"str"` prototype
     25PASS WebAssembly.Instance: cross-realm NewTarget with `symbol "Symbol()"` prototype
     26PASS WebAssembly.Instance: bound cross-realm NewTarget with `undefined` prototype
     27PASS WebAssembly.Instance: bound bound cross-realm NewTarget with `null` prototype
     28PASS WebAssembly.Instance: bound Proxy of cross-realm NewTarget with `false` prototype
     29PASS WebAssembly.Instance: Proxy of cross-realm NewTarget with `true` prototype
     30PASS WebAssembly.Instance: Proxy of Proxy of cross-realm NewTarget with `-0` prototype
     31PASS WebAssembly.Instance: Proxy of bound cross-realm NewTarget with `NaN` prototype
    3232FAIL WebAssembly.Memory: cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    3333FAIL WebAssembly.Memory: cross-realm NewTarget with `null` prototype assert_true: expected true got false
    … …  
    7575FAIL WebAssembly.Global: Proxy of Proxy of cross-realm NewTarget with `-0` prototype assert_true: expected true got false
    7676FAIL WebAssembly.Global: Proxy of bound cross-realm NewTarget with `NaN` prototype assert_true: expected true got false
    77 FAIL WebAssembly.CompileError: cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    78 FAIL WebAssembly.CompileError: cross-realm NewTarget with `null` prototype assert_true: expected true got false
    79 FAIL WebAssembly.CompileError: cross-realm NewTarget with `false` prototype assert_true: expected true got false
    80 FAIL WebAssembly.CompileError: cross-realm NewTarget with `true` prototype assert_true: expected true got false
    81 FAIL WebAssembly.CompileError: cross-realm NewTarget with `0` prototype assert_true: expected true got false
    82 FAIL WebAssembly.CompileError: cross-realm NewTarget with `-1` prototype assert_true: expected true got false
    83 FAIL WebAssembly.CompileError: cross-realm NewTarget with `""` prototype assert_true: expected true got false
    84 FAIL WebAssembly.CompileError: cross-realm NewTarget with `"str"` prototype assert_true: expected true got false
    85 FAIL WebAssembly.CompileError: cross-realm NewTarget with `symbol "Symbol()"` prototype assert_true: expected true got false
    86 FAIL WebAssembly.CompileError: bound cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    87 FAIL WebAssembly.CompileError: bound bound cross-realm NewTarget with `null` prototype assert_true: expected true got false
    88 FAIL WebAssembly.CompileError: bound Proxy of cross-realm NewTarget with `false` prototype assert_true: expected true got false
    89 FAIL WebAssembly.CompileError: Proxy of cross-realm NewTarget with `true` prototype assert_true: expected true got false
    90 FAIL WebAssembly.CompileError: Proxy of Proxy of cross-realm NewTarget with `-0` prototype assert_true: expected true got false
    91 FAIL WebAssembly.CompileError: Proxy of bound cross-realm NewTarget with `NaN` prototype assert_true: expected true got false
    92 FAIL WebAssembly.LinkError: cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    93 FAIL WebAssembly.LinkError: cross-realm NewTarget with `null` prototype assert_true: expected true got false
    94 FAIL WebAssembly.LinkError: cross-realm NewTarget with `false` prototype assert_true: expected true got false
    95 FAIL WebAssembly.LinkError: cross-realm NewTarget with `true` prototype assert_true: expected true got false
    96 FAIL WebAssembly.LinkError: cross-realm NewTarget with `0` prototype assert_true: expected true got false
    97 FAIL WebAssembly.LinkError: cross-realm NewTarget with `-1` prototype assert_true: expected true got false
    98 FAIL WebAssembly.LinkError: cross-realm NewTarget with `""` prototype assert_true: expected true got false
    99 FAIL WebAssembly.LinkError: cross-realm NewTarget with `"str"` prototype assert_true: expected true got false
    100 FAIL WebAssembly.LinkError: cross-realm NewTarget with `symbol "Symbol()"` prototype assert_true: expected true got false
    101 FAIL WebAssembly.LinkError: bound cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    102 FAIL WebAssembly.LinkError: bound bound cross-realm NewTarget with `null` prototype assert_true: expected true got false
    103 FAIL WebAssembly.LinkError: bound Proxy of cross-realm NewTarget with `false` prototype assert_true: expected true got false
    104 FAIL WebAssembly.LinkError: Proxy of cross-realm NewTarget with `true` prototype assert_true: expected true got false
    105 FAIL WebAssembly.LinkError: Proxy of Proxy of cross-realm NewTarget with `-0` prototype assert_true: expected true got false
    106 FAIL WebAssembly.LinkError: Proxy of bound cross-realm NewTarget with `NaN` prototype assert_true: expected true got false
    107 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    108 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `null` prototype assert_true: expected true got false
    109 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `false` prototype assert_true: expected true got false
    110 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `true` prototype assert_true: expected true got false
    111 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `0` prototype assert_true: expected true got false
    112 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `-1` prototype assert_true: expected true got false
    113 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `""` prototype assert_true: expected true got false
    114 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `"str"` prototype assert_true: expected true got false
    115 FAIL WebAssembly.RuntimeError: cross-realm NewTarget with `symbol "Symbol()"` prototype assert_true: expected true got false
    116 FAIL WebAssembly.RuntimeError: bound cross-realm NewTarget with `undefined` prototype assert_true: expected true got false
    117 FAIL WebAssembly.RuntimeError: bound bound cross-realm NewTarget with `null` prototype assert_true: expected true got false
    118 FAIL WebAssembly.RuntimeError: bound Proxy of cross-realm NewTarget with `false` prototype assert_true: expected true got false
    119 FAIL WebAssembly.RuntimeError: Proxy of cross-realm NewTarget with `true` prototype assert_true: expected true got false
    120 FAIL WebAssembly.RuntimeError: Proxy of Proxy of cross-realm NewTarget with `-0` prototype assert_true: expected true got false
    121 FAIL WebAssembly.RuntimeError: Proxy of bound cross-realm NewTarget with `NaN` prototype assert_true: expected true got false
     77PASS WebAssembly.CompileError: cross-realm NewTarget with `undefined` prototype
     78PASS WebAssembly.CompileError: cross-realm NewTarget with `null` prototype
     79PASS WebAssembly.CompileError: cross-realm NewTarget with `false` prototype
     80PASS WebAssembly.CompileError: cross-realm NewTarget with `true` prototype
     81PASS WebAssembly.CompileError: cross-realm NewTarget with `0` prototype
     82PASS WebAssembly.CompileError: cross-realm NewTarget with `-1` prototype
     83PASS WebAssembly.CompileError: cross-realm NewTarget with `""` prototype
     84PASS WebAssembly.CompileError: cross-realm NewTarget with `"str"` prototype
     85PASS WebAssembly.CompileError: cross-realm NewTarget with `symbol "Symbol()"` prototype
     86PASS WebAssembly.CompileError: bound cross-realm NewTarget with `undefined` prototype
     87PASS WebAssembly.CompileError: bound bound cross-realm NewTarget with `null` prototype
     88PASS WebAssembly.CompileError: bound Proxy of cross-realm NewTarget with `false` prototype
     89PASS WebAssembly.CompileError: Proxy of cross-realm NewTarget with `true` prototype
     90PASS WebAssembly.CompileError: Proxy of Proxy of cross-realm NewTarget with `-0` prototype
     91PASS WebAssembly.CompileError: Proxy of bound cross-realm NewTarget with `NaN` prototype
     92PASS WebAssembly.LinkError: cross-realm NewTarget with `undefined` prototype
     93PASS WebAssembly.LinkError: cross-realm NewTarget with `null` prototype
     94PASS WebAssembly.LinkError: cross-realm NewTarget with `false` prototype
     95PASS WebAssembly.LinkError: cross-realm NewTarget with `true` prototype
     96PASS WebAssembly.LinkError: cross-realm NewTarget with `0` prototype
     97PASS WebAssembly.LinkError: cross-realm NewTarget with `-1` prototype
     98PASS WebAssembly.LinkError: cross-realm NewTarget with `""` prototype
     99PASS WebAssembly.LinkError: cross-realm NewTarget with `"str"` prototype
     100PASS WebAssembly.LinkError: cross-realm NewTarget with `symbol "Symbol()"` prototype
     101PASS WebAssembly.LinkError: bound cross-realm NewTarget with `undefined` prototype
     102PASS WebAssembly.LinkError: bound bound cross-realm NewTarget with `null` prototype
     103PASS WebAssembly.LinkError: bound Proxy of cross-realm NewTarget with `false` prototype
     104PASS WebAssembly.LinkError: Proxy of cross-realm NewTarget with `true` prototype
     105PASS WebAssembly.LinkError: Proxy of Proxy of cross-realm NewTarget with `-0` prototype
     106PASS WebAssembly.LinkError: Proxy of bound cross-realm NewTarget with `NaN` prototype
     107PASS WebAssembly.RuntimeError: cross-realm NewTarget with `undefined` prototype
     108PASS WebAssembly.RuntimeError: cross-realm NewTarget with `null` prototype
     109PASS WebAssembly.RuntimeError: cross-realm NewTarget with `false` prototype
     110PASS WebAssembly.RuntimeError: cross-realm NewTarget with `true` prototype
     111PASS WebAssembly.RuntimeError: cross-realm NewTarget with `0` prototype
     112PASS WebAssembly.RuntimeError: cross-realm NewTarget with `-1` prototype
     113PASS WebAssembly.RuntimeError: cross-realm NewTarget with `""` prototype
     114PASS WebAssembly.RuntimeError: cross-realm NewTarget with `"str"` prototype
     115PASS WebAssembly.RuntimeError: cross-realm NewTarget with `symbol "Symbol()"` prototype
     116PASS WebAssembly.RuntimeError: bound cross-realm NewTarget with `undefined` prototype
     117PASS WebAssembly.RuntimeError: bound bound cross-realm NewTarget with `null` prototype
     118PASS WebAssembly.RuntimeError: bound Proxy of cross-realm NewTarget with `false` prototype
     119PASS WebAssembly.RuntimeError: Proxy of cross-realm NewTarget with `true` prototype
     120PASS WebAssembly.RuntimeError: Proxy of Proxy of cross-realm NewTarget with `-0` prototype
     121PASS WebAssembly.RuntimeError: Proxy of bound cross-realm NewTarget with `NaN` prototype
    122122

  • trunk/Source/JavaScriptCore/ChangeLog

    r260730 r260732  
     12020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        InternalFunction::createSubclassStructure should use newTarget's globalObject
     4        https://bugs.webkit.org/show_bug.cgi?id=202599
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        If "prototype" of NewTarget is not an object, built-in constructors [1] should acquire
     9        default [[Prototype]] from realm of NewTarget, utilizing GetFunctionRealm helper [2].
     10        Before this change, realm of active constructor was used instead. This patch introduces
     11        GetFunctionRealm and aligns all subclassable constructors with the spec, V8, and SpiderMonkey.
     12
     13        This change inlines fast paths checks of InternalFunction::createSubclassStructure() and
     14        simplifies its signature; getFunctionRealm() is invoked in slow paths only.
     15
     16        While a dynamically created function uses NewTarget's realm for its default [[Prototype]]
     17        similar to other built-ins, its "prototype" object inherit from ObjectPrototype
     18        of active constructor's realm [3] (just like their scope), making it retain references
     19        to 2 different global objects. To accomodate this behavior, this change introduces
     20        `scopeGlobalObject` in JSFunction.cpp methods.
     21
     22        Above-mentioned behavior also simplifies creation of JSGenerator and JSAsyncGenerator
     23        instances since NewTarget's realm is irrelevant to them.
     24
     25        IntlCollatorConstructor::collatorStructure() and 6 similar methods are removed:
     26        a) to impose good practice of using newTarget's globalObject;
     27        b) with this change, each of them have 1 call site max;
     28        c) other JSC constructors have no methods alike.
     29
     30        [1]: https://tc39.es/ecma262/#sec-map-constructor (step 2)
     31        [2]: https://tc39.es/ecma262/#sec-getfunctionrealm
     32        [3]: https://tc39.es/ecma262/#sec-createdynamicfunction (steps 23-25)
     33
     34        * dfg/DFGOperations.cpp:
     35        * runtime/AggregateErrorConstructor.cpp:
     36        (JSC::callAggregateErrorConstructor):
     37        (JSC::constructAggregateErrorConstructor):
     38        * runtime/AggregateErrorConstructor.h:
     39        * runtime/AsyncFunctionConstructor.cpp:
     40        (JSC::constructAsyncFunctionConstructor):
     41        * runtime/AsyncGeneratorFunctionConstructor.cpp:
     42        (JSC::constructAsyncGeneratorFunctionConstructor):
     43        * runtime/BooleanConstructor.cpp:
     44        (JSC::constructWithBooleanConstructor):
     45        * runtime/CommonSlowPaths.cpp:
     46        (JSC::SLOW_PATH_DECL):
     47        (JSC::createInternalFieldObject):
     48        * runtime/DateConstructor.cpp:
     49        (JSC::constructDate):
     50        * runtime/ErrorConstructor.cpp:
     51        (JSC::constructErrorConstructor):
     52        * runtime/FunctionConstructor.cpp:
     53        (JSC::constructFunctionSkippingEvalEnabledCheck):
     54        * runtime/InternalFunction.cpp:
     55        (JSC::InternalFunction::createSubclassStructure):
     56        (JSC::getFunctionRealm):
     57        (JSC::InternalFunction::createSubclassStructureSlow): Deleted.
     58        * runtime/InternalFunction.h:
     59        (JSC::InternalFunction::createSubclassStructure): Deleted.
     60        * runtime/IntlCollatorConstructor.cpp:
     61        (JSC::constructIntlCollator):
     62        (JSC::callIntlCollator):
     63        * runtime/IntlCollatorConstructor.h:
     64        * runtime/IntlDateTimeFormatConstructor.cpp:
     65        (JSC::constructIntlDateTimeFormat):
     66        (JSC::callIntlDateTimeFormat):
     67        * runtime/IntlDateTimeFormatConstructor.h:
     68        * runtime/IntlNumberFormatConstructor.cpp:
     69        (JSC::constructIntlNumberFormat):
     70        (JSC::callIntlNumberFormat):
     71        * runtime/IntlNumberFormatConstructor.h:
     72        * runtime/IntlPluralRulesConstructor.cpp:
     73        (JSC::constructIntlPluralRules):
     74        * runtime/IntlPluralRulesConstructor.h:
     75        * runtime/IntlRelativeTimeFormatConstructor.cpp:
     76        (JSC::constructIntlRelativeTimeFormat):
     77        * runtime/IntlRelativeTimeFormatConstructor.h:
     78        * runtime/JSArrayBufferConstructor.cpp:
     79        (JSC::JSGenericArrayBufferConstructor<sharingMode>::constructArrayBuffer):
     80        * runtime/JSFunction.cpp:
     81        (JSC::JSFunction::prototypeForConstruction):
     82        (JSC::JSFunction::getOwnPropertySlot):
     83        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
     84        (JSC::constructGenericTypedArrayView):
     85        * runtime/JSGlobalObjectInlines.h:
     86        (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation const):
     87        * runtime/MapConstructor.cpp:
     88        (JSC::constructMap):
     89        * runtime/NativeErrorConstructor.cpp:
     90        (JSC::NativeErrorConstructor<errorType>::constructNativeErrorConstructor):
     91        (JSC::NativeErrorConstructor<errorType>::callNativeErrorConstructor):
     92        * runtime/NativeErrorConstructor.h:
     93        * runtime/NumberConstructor.cpp:
     94        (JSC::constructNumberConstructor):
     95        * runtime/ObjectConstructor.cpp:
     96        (JSC::constructObjectWithNewTarget):
     97        * runtime/RegExpConstructor.cpp:
     98        (JSC::getRegExpStructure):
     99        (JSC::constructRegExp):
     100        (JSC::esSpecRegExpCreate):
     101        * runtime/RegExpConstructor.h:
     102        * runtime/SetConstructor.cpp:
     103        (JSC::constructSet):
     104        * runtime/StringConstructor.cpp:
     105        (JSC::constructWithStringConstructor):
     106        * runtime/WeakMapConstructor.cpp:
     107        (JSC::constructWeakMap):
     108        * runtime/WeakObjectRefConstructor.cpp:
     109        (JSC::constructWeakRef):
     110        * runtime/WeakSetConstructor.cpp:
     111        (JSC::constructWeakSet):
     112        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
     113        (JSC::constructJSWebAssemblyCompileError):
     114        * wasm/js/WebAssemblyInstanceConstructor.cpp:
     115        (JSC::constructJSWebAssemblyInstance):
     116        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
     117        (JSC::constructJSWebAssemblyLinkError):
     118        * wasm/js/WebAssemblyModuleConstructor.cpp:
     119        (JSC::WebAssemblyModuleConstructor::createModule):
     120        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
     121        (JSC::constructJSWebAssemblyRuntimeError):
     122
    11232020-04-26  Yusuke Suzuki  <ysuzuki@apple.com>
    2124

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r260683 r260732  
    345345    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    346346    auto scope = DECLARE_THROW_SCOPE(vm);
    347     Structure* structure = InternalFunction::createSubclassStructure(globalObject, globalObject->promiseConstructor(), constructor, globalObject->promiseStructure());
     347    Structure* structure = constructor == globalObject->promiseConstructor()
     348        ? globalObject->promiseStructure()
     349        : InternalFunction::createSubclassStructure(globalObject, constructor, getFunctionRealm(vm, constructor)->promiseStructure());
    348350    RETURN_IF_EXCEPTION(scope, nullptr);
    349351    RELEASE_AND_RETURN(scope, JSPromise::create(vm, structure));
    … …  
    356358    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    357359    auto scope = DECLARE_THROW_SCOPE(vm);
    358     Structure* structure = InternalFunction::createSubclassStructure(globalObject, globalObject->internalPromiseConstructor(), constructor, globalObject->internalPromiseStructure());
     360    Structure* structure = constructor == globalObject->internalPromiseConstructor()
     361        ? globalObject->internalPromiseStructure()
     362        : InternalFunction::createSubclassStructure(globalObject, constructor, getFunctionRealm(vm, constructor)->internalPromiseStructure());
    359363    RETURN_IF_EXCEPTION(scope, nullptr);
    360364    RELEASE_AND_RETURN(scope, JSInternalPromise::create(vm, structure));
    … …  
    367371    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    368372    auto scope = DECLARE_THROW_SCOPE(vm);
    369     Structure* structure = InternalFunction::createSubclassStructure(globalObject, nullptr, constructor, globalObject->generatorStructure());
     373    Structure* structure = InternalFunction::createSubclassStructure(globalObject, constructor, globalObject->generatorStructure());
    370374    RETURN_IF_EXCEPTION(scope, nullptr);
    371375    RELEASE_AND_RETURN(scope, JSGenerator::create(vm, structure));
    … …  
    378382    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
    379383    auto scope = DECLARE_THROW_SCOPE(vm);
    380     Structure* structure = InternalFunction::createSubclassStructure(globalObject, nullptr, constructor, globalObject->asyncGeneratorStructure());
     384    Structure* structure = InternalFunction::createSubclassStructure(globalObject, constructor, globalObject->asyncGeneratorStructure());
    381385    RETURN_IF_EXCEPTION(scope, nullptr);
    382386    RELEASE_AND_RETURN(scope, JSAsyncGenerator::create(vm, structure));

  • trunk/Source/JavaScriptCore/runtime/AggregateErrorConstructor.cpp

    r260417 r260732  
    6464    JSValue errors = callFrame->argument(0);
    6565    JSValue message = callFrame->argument(1);
    66     Structure* errorStructure = jsCast<AggregateErrorConstructor*>(callFrame->jsCallee())->errorStructure(vm);
     66    Structure* errorStructure = globalObject->errorStructure(ErrorType::AggregateError);
    6767    return JSValue::encode(AggregateError::create(globalObject, vm, errorStructure, errors, message, nullptr, TypeNothing, false));
    6868}
    … …  
    7474    JSValue errors = callFrame->argument(0);
    7575    JSValue message = callFrame->argument(1);
    76     JSValue newTarget = callFrame->newTarget();
    77     ASSERT(newTarget.isObject());
    78     Structure* baseStructure = asObject(newTarget)->globalObject(vm)->errorStructure(ErrorType::AggregateError);
    79     Structure* errorStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), newTarget, baseStructure);
    80     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     76
     77    JSObject* newTarget = asObject(callFrame->newTarget());
     78    Structure* errorStructure = newTarget == callFrame->jsCallee()
     79        ? globalObject->errorStructure(ErrorType::AggregateError)
     80        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->errorStructure(ErrorType::AggregateError));
     81    RETURN_IF_EXCEPTION(scope, { });
    8182    ASSERT(errorStructure);
     83
    8284    RELEASE_AND_RETURN(scope, JSValue::encode(AggregateError::create(globalObject, vm, errorStructure, errors, message, nullptr, TypeNothing, false)));
    8385}

  • trunk/Source/JavaScriptCore/runtime/AggregateErrorConstructor.h

    r260273 r260732  
    5656    }
    5757
    58     Structure* errorStructure(VM&) { return globalObject()->errorStructure(ErrorType::AggregateError); }
    59 
    6058private:
    6159    explicit AggregateErrorConstructor(VM&, Structure*);

  • trunk/Source/JavaScriptCore/runtime/AsyncFunctionConstructor.cpp

    r252520 r260732  
    4646{
    4747    ArgList args(callFrame);
    48     return JSValue::encode(constructFunction(globalObject, callFrame, args, FunctionConstructionMode::Async));
     48    return JSValue::encode(constructFunction(globalObject, callFrame, args, FunctionConstructionMode::Async, callFrame->newTarget()));
    4949}
    5050

  • trunk/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionConstructor.cpp

    r252520 r260732  
    4646{
    4747    ArgList args(callFrame);
    48     return JSValue::encode(constructFunction(globalObject, callFrame, args, FunctionConstructionMode::AsyncGenerator));
     48    return JSValue::encode(constructFunction(globalObject, callFrame, args, FunctionConstructionMode::AsyncGenerator, callFrame->newTarget()));
    4949}
    5050

  • trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp

    r252520 r260732  
    4444    auto scope = DECLARE_THROW_SCOPE(vm);
    4545    JSValue boolean = jsBoolean(callFrame->argument(0).toBoolean(globalObject));
    46     Structure* booleanStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->booleanObjectStructure());
    47     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     46
     47    JSObject* newTarget = asObject(callFrame->newTarget());
     48    Structure* booleanStructure = newTarget == callFrame->jsCallee()
     49        ? globalObject->booleanObjectStructure()
     50        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->booleanObjectStructure());
     51    RETURN_IF_EXCEPTION(scope, { });
     52
    4853    BooleanObject* obj = BooleanObject::create(vm, booleanStructure);
    4954    obj->setInternalValue(vm, boolean);

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r260683 r260732  
    284284    JSPromise* result = nullptr;
    285285    if (bytecode.m_isInternalPromise) {
    286         Structure* structure = InternalFunction::createSubclassStructure(globalObject, globalObject->internalPromiseConstructor(), constructorAsObject, globalObject->internalPromiseStructure());
     286        Structure* structure = constructorAsObject == globalObject->internalPromiseConstructor()
     287            ? globalObject->internalPromiseStructure()
     288            : InternalFunction::createSubclassStructure(globalObject, constructorAsObject, getFunctionRealm(vm, constructorAsObject)->internalPromiseStructure());
    287289        CHECK_EXCEPTION();
    288290        result = JSInternalPromise::create(vm, structure);
    289291    } else {
    290         Structure* structure = InternalFunction::createSubclassStructure(globalObject, globalObject->promiseConstructor(), constructorAsObject, globalObject->promiseStructure());
     292        Structure* structure = constructorAsObject == globalObject->promiseConstructor()
     293            ? globalObject->promiseStructure()
     294            : InternalFunction::createSubclassStructure(globalObject, constructorAsObject, getFunctionRealm(vm, constructorAsObject)->promiseStructure());
    291295        CHECK_EXCEPTION();
    292296        result = JSPromise::create(vm, structure);
    … …  
    321325    auto scope = DECLARE_THROW_SCOPE(vm);
    322326
    323     Structure* structure = InternalFunction::createSubclassStructure(globalObject, nullptr, constructorAsObject, baseStructure);
     327    Structure* structure = InternalFunction::createSubclassStructure(globalObject, constructorAsObject, baseStructure);
    324328    RETURN_IF_EXCEPTION(scope, nullptr);
    325329    JSClass* result = JSClass::create(vm, structure);

  • trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp

    r252520 r260732  
    144144    RETURN_IF_EXCEPTION(scope, nullptr);
    145145
    146     Structure* dateStructure = InternalFunction::createSubclassStructure(globalObject, globalObject->dateConstructor(), newTarget, globalObject->dateStructure());
     146    Structure* dateStructure = !newTarget || newTarget == globalObject->dateConstructor()
     147        ? globalObject->dateStructure()
     148        : InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), getFunctionRealm(vm, asObject(newTarget))->dateStructure());
    147149    RETURN_IF_EXCEPTION(scope, nullptr);
    148150

  • trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp

    r257399 r260732  
    5858    auto scope = DECLARE_THROW_SCOPE(vm);
    5959    JSValue message = callFrame->argument(0);
    60     Structure* errorStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->errorStructure());
    61     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     60
     61    JSObject* newTarget = asObject(callFrame->newTarget());
     62    Structure* errorStructure = newTarget == callFrame->jsCallee()
     63        ? globalObject->errorStructure()
     64        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->errorStructure());
     65    RETURN_IF_EXCEPTION(scope, { });
     66
    6267    RELEASE_AND_RETURN(scope, JSValue::encode(ErrorInstance::create(globalObject, errorStructure, message, nullptr, TypeNothing, false)));
    6368}

  • trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp

    r252520 r260732  
    153153    }
    154154
     155    bool needsSubclassStructure = newTarget && newTarget != globalObject->functionConstructor();
     156    JSGlobalObject* structureGlobalObject = needsSubclassStructure ? getFunctionRealm(vm, asObject(newTarget)) : globalObject;
    155157    Structure* structure = nullptr;
    156158    switch (functionConstructionMode) {
    157159    case FunctionConstructionMode::Function:
    158         structure = JSFunction::selectStructureForNewFuncExp(globalObject, function);
     160        structure = JSFunction::selectStructureForNewFuncExp(structureGlobalObject, function);
    159161        break;
    160162    case FunctionConstructionMode::Generator:
    161         structure = globalObject->generatorFunctionStructure();
     163        structure = structureGlobalObject->generatorFunctionStructure();
    162164        break;
    163165    case FunctionConstructionMode::Async:
    164         structure = globalObject->asyncFunctionStructure();
     166        structure = structureGlobalObject->asyncFunctionStructure();
    165167        break;
    166168    case FunctionConstructionMode::AsyncGenerator:
    167         structure = globalObject->asyncGeneratorFunctionStructure();
    168         break;
    169     }
    170 
    171     Structure* subclassStructure = InternalFunction::createSubclassStructure(globalObject, globalObject->functionConstructor(), newTarget, structure);
    172     RETURN_IF_EXCEPTION(scope, nullptr);
     169        structure = structureGlobalObject->asyncGeneratorFunctionStructure();
     170        break;
     171    }
     172
     173    if (needsSubclassStructure) {
     174        structure = InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), structure);
     175        RETURN_IF_EXCEPTION(scope, nullptr);
     176    }
    173177
    174178    switch (functionConstructionMode) {
    175179    case FunctionConstructionMode::Function:
    176         return JSFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
     180        return JSFunction::create(vm, function, globalObject->globalScope(), structure);
    177181    case FunctionConstructionMode::Generator:
    178         return JSGeneratorFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
     182        return JSGeneratorFunction::create(vm, function, globalObject->globalScope(), structure);
    179183    case FunctionConstructionMode::Async:
    180         return JSAsyncFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
     184        return JSAsyncFunction::create(vm, function, globalObject->globalScope(), structure);
    181185    case FunctionConstructionMode::AsyncGenerator:
    182         return JSAsyncGeneratorFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
     186        return JSAsyncGeneratorFunction::create(vm, function, globalObject->globalScope(), structure);
    183187    }
    184188

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp

    r253932 r260732  
    2525
    2626#include "FunctionPrototype.h"
     27#include "JSBoundFunction.h"
     28#include "JSCInlines.h"
    2729#include "JSGlobalObject.h"
    2830#include "JSString.h"
    29 #include "JSCInlines.h"
     31#include "ProxyObject.h"
    3032
    3133namespace JSC {
    … …  
    113115}
    114116
    115 Structure* InternalFunction::createSubclassStructureSlow(JSGlobalObject* globalObject, JSValue newTarget, Structure* baseClass)
     117Structure* InternalFunction::createSubclassStructure(JSGlobalObject* globalObject, JSObject* newTarget, Structure* baseClass)
    116118{
    117119    VM& vm = globalObject->vm();
    … …  
    136138            return rareData->createInternalFunctionAllocationStructureFromBase(vm, baseGlobalObject, prototype, baseClass);
    137139    } else {
    138         JSValue prototypeValue = newTarget.get(globalObject, vm.propertyNames->prototype);
     140        JSValue prototypeValue = newTarget->get(globalObject, vm.propertyNames->prototype);
    139141        RETURN_IF_EXCEPTION(scope, nullptr);
    140142        if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue)) {
    … …  
    148150}
    149151
     152// https://tc39.es/ecma262/#sec-getfunctionrealm
     153JSGlobalObject* getFunctionRealm(VM& vm, JSObject* object)
     154{
     155    ASSERT(object->isFunction(vm));
     156
     157    if (object->inherits<JSBoundFunction>(vm))
     158        return getFunctionRealm(vm, jsCast<JSBoundFunction*>(object)->targetFunction());
     159
     160    if (object->type() == ProxyObjectType) {
     161        auto* proxy = jsCast<ProxyObject*>(object);
     162        // Per step 4.a, a TypeError should be thrown for revoked Proxy, yet we skip it since:
     163        // a) It is barely observable anyway: "prototype" lookup in createSubclassStructure() will throw for revoked Proxy.
     164        // b) Throwing getFunctionRealm() will restrict calling it inline as an argument of createSubclassStructure().
     165        // c) There is ongoing discussion on removing it: https://github.com/tc39/ecma262/issues/1798.
     166        if (!proxy->isRevoked())
     167            return getFunctionRealm(vm, proxy->target());
     168    }
     169
     170    return object->globalObject(vm);
     171}
     172
    150173
    151174} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.h

    r252875 r260732  
    5858    }
    5959
    60     static Structure* createSubclassStructure(JSGlobalObject*, JSObject* baseCallee, JSValue newTarget, Structure*);
     60    JS_EXPORT_PRIVATE static Structure* createSubclassStructure(JSGlobalObject*, JSObject* newTarget, Structure*);
    6161
    6262    TaggedNativeFunction nativeFunctionFor(CodeSpecializationKind kind)
    … …  
    8989    JS_EXPORT_PRIVATE void finishCreation(VM&, const String& name, NameAdditionMode = NameAdditionMode::WithStructureTransition);
    9090
    91     JS_EXPORT_PRIVATE static Structure* createSubclassStructureSlow(JSGlobalObject*, JSValue newTarget, Structure*);
    92 
    9391    JS_EXPORT_PRIVATE static ConstructType getConstructData(JSCell*, ConstructData&);
    9492    JS_EXPORT_PRIVATE static CallType getCallData(JSCell*, CallData&);
    … …  
    10098};
    10199
    102 ALWAYS_INLINE Structure* InternalFunction::createSubclassStructure(JSGlobalObject* globalObject, JSObject* baseCallee, JSValue newTarget, Structure* baseClass)
    103 {
    104     // We allow newTarget == JSValue() because the API needs to be able to create classes without having a real JS frame.
    105     // Since we don't allow subclassing in the API we just treat newTarget == JSValue() as newTarget == callFrame->jsCallee()
    106     if (newTarget && newTarget != baseCallee)
    107         return createSubclassStructureSlow(globalObject, newTarget, baseClass);
    108     return baseClass;
    109 }
     100JS_EXPORT_PRIVATE JSGlobalObject* getFunctionRealm(VM&, JSObject*);
    110101
    111102} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp

    r259767 r260732  
    9292    // 2. Let collator be OrdinaryCreateFromConstructor(newTarget, %CollatorPrototype%).
    9393    // 3. ReturnIfAbrupt(collator).
    94     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), jsCast<IntlCollatorConstructor*>(callFrame->jsCallee())->collatorStructure(vm));
    95     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     94    JSObject* newTarget = asObject(callFrame->newTarget());
     95    Structure* structure = newTarget == callFrame->jsCallee()
     96        ? globalObject->collatorStructure()
     97        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->collatorStructure());
     98    RETURN_IF_EXCEPTION(scope, { });
     99
    96100    IntlCollator* collator = IntlCollator::create(vm, structure);
    97101    ASSERT(collator);
    … …  
    110114
    111115    VM& vm = globalObject->vm();
    112     IntlCollatorConstructor* callee = jsCast<IntlCollatorConstructor*>(callFrame->jsCallee());
    113 
    114     // FIXME: Collator does not get the workaround for ECMA-402 1.0 compatibility.
     116    // Collator does not require the workaround for ECMA-402 1.0 compatibility.
    115117    // https://bugs.webkit.org/show_bug.cgi?id=153679
    116118
    117119    // 2. Let collator be OrdinaryCreateFromConstructor(newTarget, %CollatorPrototype%).
    118120    // 3. ReturnIfAbrupt(collator).
    119     IntlCollator* collator = IntlCollator::create(vm, callee->collatorStructure(vm));
     121    IntlCollator* collator = IntlCollator::create(vm, globalObject->collatorStructure());
    120122    ASSERT(collator);
    121123

  • trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h

    r260415 r260732  
    4444    DECLARE_INFO;
    4545
    46     Structure* collatorStructure(VM&) const { return globalObject()->collatorStructure(); }
    47 
    4846private:
    4947    IntlCollatorConstructor(VM&, Structure*);

  • trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp

    r259767 r260732  
    9292    // 2. Let dateTimeFormat be OrdinaryCreateFromConstructor(newTarget, %DateTimeFormatPrototype%).
    9393    // 3. ReturnIfAbrupt(dateTimeFormat).
    94     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), jsCast<IntlDateTimeFormatConstructor*>(callFrame->jsCallee())->dateTimeFormatStructure(vm));
    95     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     94    JSObject* newTarget = asObject(callFrame->newTarget());
     95    Structure* structure = newTarget == callFrame->jsCallee()
     96        ? globalObject->dateTimeFormatStructure()
     97        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->dateTimeFormatStructure());
     98    RETURN_IF_EXCEPTION(scope, { });
     99
    96100    IntlDateTimeFormat* dateTimeFormat = IntlDateTimeFormat::create(vm, structure);
    97101    ASSERT(dateTimeFormat);
    … …  
    109113    // NewTarget is always undefined when called as a function.
    110114
    111     IntlDateTimeFormatConstructor* callee = jsCast<IntlDateTimeFormatConstructor*>(callFrame->jsCallee());
    112 
    113115    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
    114116    // https://bugs.webkit.org/show_bug.cgi?id=153679
    115     return JSValue::encode(constructIntlInstanceWithWorkaroundForLegacyIntlConstructor<IntlDateTimeFormat>(globalObject, callFrame->thisValue(), callee, [&] (VM& vm) {
     117    return JSValue::encode(constructIntlInstanceWithWorkaroundForLegacyIntlConstructor<IntlDateTimeFormat>(globalObject, callFrame->thisValue(), callFrame->jsCallee(), [&] (VM& vm) {
    116118        // 2. Let dateTimeFormat be OrdinaryCreateFromConstructor(newTarget, %DateTimeFormatPrototype%).
    117119        // 3. ReturnIfAbrupt(dateTimeFormat).
    118         IntlDateTimeFormat* dateTimeFormat = IntlDateTimeFormat::create(vm, callee->dateTimeFormatStructure(vm));
     120        IntlDateTimeFormat* dateTimeFormat = IntlDateTimeFormat::create(vm, globalObject->dateTimeFormatStructure());
    119121        ASSERT(dateTimeFormat);
    120122

  • trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h

    r260415 r260732  
    4444    DECLARE_INFO;
    4545
    46     Structure* dateTimeFormatStructure(VM&) const { return globalObject()->dateTimeFormatStructure(); }
    47 
    4846private:
    4947    IntlDateTimeFormatConstructor(VM&, Structure*);

  • trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp

    r259767 r260732  
    9292    // 2. Let numberFormat be OrdinaryCreateFromConstructor(newTarget, %NumberFormatPrototype%).
    9393    // 3. ReturnIfAbrupt(numberFormat).
    94     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), jsCast<IntlNumberFormatConstructor*>(callFrame->jsCallee())->numberFormatStructure(vm));
    95     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     94    JSObject* newTarget = asObject(callFrame->newTarget());
     95    Structure* structure = newTarget == callFrame->jsCallee()
     96        ? globalObject->numberFormatStructure()
     97        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->numberFormatStructure());
     98    RETURN_IF_EXCEPTION(scope, { });
     99
    96100    IntlNumberFormat* numberFormat = IntlNumberFormat::create(vm, structure);
    97101    ASSERT(numberFormat);
    … …  
    109113    // NewTarget is always undefined when called as a function.
    110114
    111     IntlNumberFormatConstructor* callee = jsCast<IntlNumberFormatConstructor*>(callFrame->jsCallee());
    112 
    113115    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
    114116    // https://bugs.webkit.org/show_bug.cgi?id=153679
    115     return JSValue::encode(constructIntlInstanceWithWorkaroundForLegacyIntlConstructor<IntlNumberFormat>(globalObject, callFrame->thisValue(), callee, [&] (VM& vm) {
     117    return JSValue::encode(constructIntlInstanceWithWorkaroundForLegacyIntlConstructor<IntlNumberFormat>(globalObject, callFrame->thisValue(), callFrame->jsCallee(), [&] (VM& vm) {
    116118        // 2. Let numberFormat be OrdinaryCreateFromConstructor(newTarget, %NumberFormatPrototype%).
    117119        // 3. ReturnIfAbrupt(numberFormat).
    118         IntlNumberFormat* numberFormat = IntlNumberFormat::create(vm, callee->numberFormatStructure(vm));
     120        IntlNumberFormat* numberFormat = IntlNumberFormat::create(vm, globalObject->numberFormatStructure());
    119121        ASSERT(numberFormat);
    120122

  • trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h

    r260415 r260732  
    4444    DECLARE_INFO;
    4545
    46     Structure* numberFormatStructure(VM&) const { return globalObject()->numberFormatStructure(); }
    47 
    4846private:
    4947    IntlNumberFormatConstructor(VM&, Structure*);

  • trunk/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.cpp

    r259767 r260732  
    9090    // 13.2.1 Intl.PluralRules ([ locales [ , options ] ])
    9191    // https://tc39.github.io/ecma402/#sec-intl.pluralrules
    92     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), jsCast<IntlPluralRulesConstructor*>(callFrame->jsCallee())->pluralRulesStructure(vm));
    93     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     92    JSObject* newTarget = asObject(callFrame->newTarget());
     93    Structure* structure = newTarget == callFrame->jsCallee()
     94        ? globalObject->pluralRulesStructure()
     95        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->pluralRulesStructure());
     96    RETURN_IF_EXCEPTION(scope, { });
     97
    9498    IntlPluralRules* pluralRules = IntlPluralRules::create(vm, structure);
    9599    ASSERT(pluralRules);

  • trunk/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.h

    r260415 r260732  
    4444    DECLARE_INFO;
    4545
    46     Structure* pluralRulesStructure(VM&) const { return globalObject()->pluralRulesStructure(); }
    47 
    4846private:
    4947    IntlPluralRulesConstructor(VM&, Structure*);

  • trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatConstructor.cpp

    r260349 r260732  
    8888    auto scope = DECLARE_THROW_SCOPE(vm);
    8989
    90     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), jsCast<IntlRelativeTimeFormatConstructor*>(callFrame->jsCallee())->relativeTimeFormatStructure(vm));
    91     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     90    JSObject* newTarget = asObject(callFrame->newTarget());
     91    Structure* structure = newTarget == callFrame->jsCallee()
     92        ? globalObject->relativeTimeFormatStructure()
     93        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->relativeTimeFormatStructure());
     94    RETURN_IF_EXCEPTION(scope, { });
     95
    9296    IntlRelativeTimeFormat* relativeTimeFormat = IntlRelativeTimeFormat::create(vm, structure);
    9397    ASSERT(relativeTimeFormat);

  • trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatConstructor.h

    r260415 r260732  
    4343    DECLARE_INFO;
    4444
    45     Structure* relativeTimeFormatStructure(VM&) const { return globalObject()->relativeTimeFormatStructure(); }
    46 
    4745private:
    4846    IntlRelativeTimeFormatConstructor(VM&, Structure*);

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp

    r252520 r260732  
    8080    auto scope = DECLARE_THROW_SCOPE(vm);
    8181
    82     JSGenericArrayBufferConstructor* constructor = jsCast<JSGenericArrayBufferConstructor*>(callFrame->jsCallee());
    83 
    84     Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), constructor->globalObject()->arrayBufferStructure(sharingMode));
     82    JSObject* newTarget = asObject(callFrame->newTarget());
     83    Structure* arrayBufferStructure = newTarget == callFrame->jsCallee()
     84        ? globalObject->arrayBufferStructure(sharingMode)
     85        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->arrayBufferStructure(sharingMode));
    8586    RETURN_IF_EXCEPTION(scope, { });
    8687

  • trunk/Source/JavaScriptCore/runtime/JSFunction.cpp

    r259676 r260732  
    175175    if (LIKELY(prototype.isObject()))
    176176        return asObject(prototype);
    177 
    178     JSGlobalObject* thisGlobalObject = this->globalObject();
    179     if (!isHostOrBuiltinFunction()) {
    180         // https://tc39.github.io/ecma262/#sec-generator-function-definitions-runtime-semantics-evaluatebody
    181         if (isGeneratorWrapperParseMode(jsExecutable()->parseMode()))
    182             return thisGlobalObject->generatorPrototype();
    183 
    184         // https://tc39.github.io/ecma262/#sec-asyncgenerator-definitions-evaluatebody
    185         if (isAsyncGeneratorWrapperParseMode(jsExecutable()->parseMode()))
    186             return thisGlobalObject->asyncGeneratorPrototype();
    187     }
    188     return thisGlobalObject->objectPrototype();
     177    if (isHostOrBuiltinFunction())
     178        return this->globalObject()->objectPrototype();
     179
     180    JSGlobalObject* scopeGlobalObject = this->scope()->globalObject();
     181    // https://tc39.github.io/ecma262/#sec-generator-function-definitions-runtime-semantics-evaluatebody
     182    if (isGeneratorWrapperParseMode(jsExecutable()->parseMode()))
     183        return scopeGlobalObject->generatorPrototype();
     184    // https://tc39.github.io/ecma262/#sec-asyncgenerator-definitions-evaluatebody
     185    if (isAsyncGeneratorWrapperParseMode(jsExecutable()->parseMode()))
     186        return scopeGlobalObject->asyncGeneratorPrototype();
     187    return scopeGlobalObject->objectPrototype();
    189188}
    190189
    … …  
    461460        PropertyOffset offset = thisObject->getDirectOffset(vm, propertyName, attributes);
    462461        if (!isValidOffset(offset)) {
     462            JSGlobalObject* scopeGlobalObject = thisObject->scope()->globalObject();
    463463            JSObject* prototype = nullptr;
    464464            if (isGeneratorWrapperParseMode(thisObject->jsExecutable()->parseMode())) {
    … …  
    466466                // property does not have a constructor property whose value is the GeneratorFunction instance.
    467467                // https://tc39.github.io/ecma262/#sec-generatorfunction-instances-prototype
    468                 prototype = constructEmptyObject(globalObject, thisObject->globalObject()->generatorPrototype());
     468                prototype = constructEmptyObject(globalObject, scopeGlobalObject->generatorPrototype());
    469469            } else if (isAsyncGeneratorWrapperParseMode(thisObject->jsExecutable()->parseMode()))
    470                 prototype = constructEmptyObject(globalObject, thisObject->globalObject()->asyncGeneratorPrototype());
     470                prototype = constructEmptyObject(globalObject, scopeGlobalObject->asyncGeneratorPrototype());
    471471            else {
    472                 prototype = constructEmptyObject(globalObject);
     472                prototype = constructEmptyObject(globalObject, scopeGlobalObject->objectPrototype());
    473473                prototype->putDirect(vm, vm.propertyNames->constructor, thisObject, static_cast<unsigned>(PropertyAttribute::DontEnum));
    474474            }

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h

    r252520 r260732  
    212212    auto scope = DECLARE_THROW_SCOPE(vm);
    213213
    214     InternalFunction* function = jsCast<InternalFunction*>(callFrame->jsCallee());
    215     Structure* parentStructure = function->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType);
    216     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), parentStructure);
    217     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     214    JSObject* newTarget = asObject(callFrame->newTarget());
     215    Structure* structure = newTarget == callFrame->jsCallee()
     216        ? globalObject->typedArrayStructure(ViewClass::TypedArrayStorageType)
     217        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->typedArrayStructure(ViewClass::TypedArrayStorageType));
     218    RETURN_IF_EXCEPTION(scope, { });
    218219
    219220    size_t argCount = callFrame->argumentCount();

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h

    r252032 r260732  
    102102ALWAYS_INLINE Structure* JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation(JSGlobalObject* globalObject, IndexingType indexingType, JSValue newTarget) const
    103103{
    104     return InternalFunction::createSubclassStructure(globalObject, globalObject->arrayConstructor(), newTarget, arrayStructureForIndexingTypeDuringAllocation(indexingType));
     104    return !newTarget || newTarget == globalObject->arrayConstructor()
     105        ? globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)
     106        : InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), getFunctionRealm(globalObject->vm(), asObject(newTarget))->arrayStructureForIndexingTypeDuringAllocation(indexingType));
    105107}
    106108

  • trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp

    r252520 r260732  
    6868    auto scope = DECLARE_THROW_SCOPE(vm);
    6969
    70     Structure* mapStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->mapStructure());
    71     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     70    JSObject* newTarget = asObject(callFrame->newTarget());
     71    Structure* mapStructure = newTarget == callFrame->jsCallee()
     72        ? globalObject->mapStructure()
     73        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->mapStructure());
     74    RETURN_IF_EXCEPTION(scope, { });
    7275
    7376    JSValue iterable = callFrame->argument(0);

  • trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp

    r252520 r260732  
    5656    auto scope = DECLARE_THROW_SCOPE(vm);
    5757    JSValue message = callFrame->argument(0);
    58     Structure* errorStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), jsCast<NativeErrorConstructor*>(callFrame->jsCallee())->errorStructure(vm));
    59     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     58
     59    JSObject* newTarget = asObject(callFrame->newTarget());
     60    Structure* errorStructure = newTarget == callFrame->jsCallee()
     61        ? globalObject->errorStructure(errorType)
     62        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->errorStructure(errorType));
     63    RETURN_IF_EXCEPTION(scope, { });
    6064    ASSERT(errorStructure);
     65
    6166    RELEASE_AND_RETURN(scope, JSValue::encode(ErrorInstance::create(globalObject, errorStructure, message, nullptr, TypeNothing, false)));
    6267}
    … …  
    6570EncodedJSValue JSC_HOST_CALL NativeErrorConstructor<errorType>::callNativeErrorConstructor(JSGlobalObject* globalObject, CallFrame* callFrame)
    6671{
    67     VM& vm = globalObject->vm();
    6872    JSValue message = callFrame->argument(0);
    69     Structure* errorStructure = jsCast<NativeErrorConstructor*>(callFrame->jsCallee())->errorStructure(vm);
     73    Structure* errorStructure = globalObject->errorStructure(errorType);
    7074    return JSValue::encode(ErrorInstance::create(globalObject, errorStructure, message, nullptr, TypeNothing, false));
    7175}

  • trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.h

    r253019 r260732  
    6060        return constructor;
    6161    }
    62 
    63     Structure* errorStructure(VM&) { return globalObject()->errorStructure(errorType); }
    6462private:
    6563    static EncodedJSValue JSC_HOST_CALL callNativeErrorConstructor(JSGlobalObject*, CallFrame*);

  • trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp

    r252520 r260732  
    9393    double n = callFrame->argumentCount() ? callFrame->uncheckedArgument(0).toNumber(globalObject) : 0;
    9494    RETURN_IF_EXCEPTION(scope, encodedJSValue());
    95     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->numberObjectStructure());
    96     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     95
     96    JSObject* newTarget = asObject(callFrame->newTarget());
     97    Structure* structure = newTarget == callFrame->jsCallee()
     98        ? globalObject->numberObjectStructure()
     99        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->numberObjectStructure());
     100    RETURN_IF_EXCEPTION(scope, { });
    97101
    98102    NumberObject* object = NumberObject::create(vm, structure);

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r260722 r260732  
    127127    if (newTarget && newTarget != objectConstructor) {
    128128        // a. Return ? OrdinaryCreateFromConstructor(NewTarget, "%ObjectPrototype%").
    129         Structure* objectStructure = InternalFunction::createSubclassStructure(globalObject, objectConstructor, newTarget, globalObject->objectStructureForObjectConstructor());
     129        Structure* baseStructure = getFunctionRealm(vm, asObject(newTarget))->objectStructureForObjectConstructor();
     130        Structure* objectStructure = InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), baseStructure);
    130131        RETURN_IF_EXCEPTION(scope, nullptr);
    131132        return constructEmptyObject(vm, objectStructure);

  • trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp

    r252520 r260732  
    173173inline Structure* getRegExpStructure(JSGlobalObject* globalObject, JSValue newTarget)
    174174{
    175     Structure* structure = globalObject->regExpStructure();
    176     if (newTarget != jsUndefined())
    177         structure = InternalFunction::createSubclassStructure(globalObject, globalObject->regExpConstructor(), newTarget, structure);
    178     return structure;
     175    return !newTarget || newTarget == globalObject->regExpConstructor()
     176        ? globalObject->regExpStructure()
     177        : InternalFunction::createSubclassStructure(globalObject, asObject(newTarget), getFunctionRealm(globalObject->vm(), asObject(newTarget))->regExpStructure());
    179178}
    180179
    … …  
    230229    RETURN_IF_EXCEPTION(scope, nullptr);
    231230
    232     if (newTarget.isUndefined() && constructAsRegexp && flagsArg.isUndefined()) {
     231    if (!newTarget && constructAsRegexp && flagsArg.isUndefined()) {
    233232        JSValue constructor = patternArg.get(globalObject, vm.propertyNames->constructor);
    234233        RETURN_IF_EXCEPTION(scope, nullptr);
    … …  
    275274    JSValue patternArg = callFrame->argument(0);
    276275    JSValue flagsArg = callFrame->argument(1);
    277     return JSValue::encode(regExpCreate(globalObject, jsUndefined(), patternArg, flagsArg));
     276    return JSValue::encode(regExpCreate(globalObject, JSValue(), patternArg, flagsArg));
    278277}
    279278

  • trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h

    r260415 r260732  
    5656STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(RegExpConstructor, InternalFunction);
    5757
    58 JSObject* constructRegExp(JSGlobalObject*, const ArgList&, JSObject* callee = nullptr, JSValue newTarget = jsUndefined());
     58JSObject* constructRegExp(JSGlobalObject*, const ArgList&, JSObject* callee = nullptr, JSValue newTarget = JSValue());
    5959
    6060ALWAYS_INLINE bool isRegExp(VM& vm, JSGlobalObject* globalObject, JSValue value)

  • trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp

    r252520 r260732  
    6868    auto scope = DECLARE_THROW_SCOPE(vm);
    6969
    70     Structure* setStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->setStructure());
    71     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     70    JSObject* newTarget = asObject(callFrame->newTarget());
     71    Structure* setStructure = newTarget == callFrame->jsCallee()
     72        ? globalObject->setStructure()
     73        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->setStructure());
     74    RETURN_IF_EXCEPTION(scope, { });
    7275
    7376    JSValue iterable = callFrame->argument(0);

  • trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp

    r252520 r260732  
    145145    auto scope = DECLARE_THROW_SCOPE(vm);
    146146
    147     Structure* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->stringObjectStructure());
    148     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     147    JSObject* newTarget = asObject(callFrame->newTarget());
     148    Structure* structure = newTarget == callFrame->jsCallee()
     149        ? globalObject->stringObjectStructure()
     150        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->stringObjectStructure());
     151    RETURN_IF_EXCEPTION(scope, { });
    149152
    150153    if (!callFrame->argumentCount())

  • trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp

    r252520 r260732  
    6666    auto scope = DECLARE_THROW_SCOPE(vm);
    6767
    68     Structure* weakMapStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->weakMapStructure());
    69     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     68    JSObject* newTarget = asObject(callFrame->newTarget());
     69    Structure* weakMapStructure = newTarget == callFrame->jsCallee()
     70        ? globalObject->weakMapStructure()
     71        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->weakMapStructure());
     72    RETURN_IF_EXCEPTION(scope, { });
     73
    7074    JSWeakMap* weakMap = JSWeakMap::create(vm, weakMapStructure);
    7175    JSValue iterable = callFrame->argument(0);

  • trunk/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.cpp

    r252520 r260732  
    6969        return throwVMTypeError(globalObject, scope, "First argument to WeakRef should be an object"_s);
    7070
    71     Structure* WeakObjectRefStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->weakObjectRefStructure());
    72     RETURN_IF_EXCEPTION(scope, encodedJSValue());
    73     RELEASE_AND_RETURN(scope, JSValue::encode(JSWeakObjectRef::create(vm, WeakObjectRefStructure, callFrame->uncheckedArgument(0).getObject())));
     71    JSObject* newTarget = asObject(callFrame->newTarget());
     72    Structure* weakObjectRefStructure = newTarget == callFrame->jsCallee()
     73        ? globalObject->weakObjectRefStructure()
     74        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->weakObjectRefStructure());
     75    RETURN_IF_EXCEPTION(scope, { });
     76
     77    RELEASE_AND_RETURN(scope, JSValue::encode(JSWeakObjectRef::create(vm, weakObjectRefStructure, callFrame->uncheckedArgument(0).getObject())));
    7478}
    7579

  • trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp

    r252520 r260732  
    6666    auto scope = DECLARE_THROW_SCOPE(vm);
    6767
    68     Structure* weakSetStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->weakSetStructure());
    69     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     68    JSObject* newTarget = asObject(callFrame->newTarget());
     69    Structure* weakSetStructure = newTarget == callFrame->jsCallee()
     70        ? globalObject->weakSetStructure()
     71        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->weakSetStructure());
     72    RETURN_IF_EXCEPTION(scope, { });
     73
    7074    JSWeakSet* weakSet = JSWeakSet::create(vm, weakSetStructure);
    7175    JSValue iterable = callFrame->argument(0);

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.cpp

    r252520 r260732  
    5050    auto scope = DECLARE_THROW_SCOPE(vm);
    5151    JSValue message = callFrame->argument(0);
    52     auto* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->webAssemblyCompileErrorStructure());
    53     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     52
     53    JSObject* newTarget = asObject(callFrame->newTarget());
     54    Structure* structure = newTarget == callFrame->jsCallee()
     55        ? globalObject->webAssemblyCompileErrorStructure()
     56        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyCompileErrorStructure());
     57    RETURN_IF_EXCEPTION(scope, { });
     58
    5459    RELEASE_AND_RETURN(scope, JSValue::encode(JSWebAssemblyCompileError::create(globalObject, vm, structure, message)));
    5560}

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp

    r253140 r260732  
    7575    if (!importArgument.isUndefined() && !importObject)
    7676        return JSValue::encode(throwException(globalObject, scope, createTypeError(globalObject, "second argument to WebAssembly.Instance must be undefined or an Object"_s, defaultSourceAppender, runtimeTypeForValue(vm, importArgument))));
    77    
    78     Structure* instanceStructure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->webAssemblyInstanceStructure());
     77
     78    JSObject* newTarget = asObject(callFrame->newTarget());
     79    Structure* instanceStructure = newTarget == callFrame->jsCallee()
     80        ? globalObject->webAssemblyInstanceStructure()
     81        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyInstanceStructure());
    7982    RETURN_IF_EXCEPTION(scope, { });
    8083

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.cpp

    r252520 r260732  
    5050    auto scope = DECLARE_THROW_SCOPE(vm);
    5151    JSValue message = callFrame->argument(0);
    52     auto* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->webAssemblyLinkErrorStructure());
    53     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     52
     53    JSObject* newTarget = asObject(callFrame->newTarget());
     54    Structure* structure = newTarget == callFrame->jsCallee()
     55        ? globalObject->webAssemblyLinkErrorStructure()
     56        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyLinkErrorStructure());
     57    RETURN_IF_EXCEPTION(scope, { });
     58
    5459    RELEASE_AND_RETURN(scope, JSValue::encode(JSWebAssemblyLinkError::create(globalObject, vm, structure, message)));
    5560}

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp

    r252520 r260732  
    182182    auto scope = DECLARE_THROW_SCOPE(vm);
    183183
    184     auto* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->webAssemblyModuleStructure());
     184    JSObject* newTarget = asObject(callFrame->newTarget());
     185    Structure* structure = newTarget == callFrame->jsCallee()
     186        ? globalObject->webAssemblyModuleStructure()
     187        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyModuleStructure());
    185188    RETURN_IF_EXCEPTION(scope, nullptr);
    186189

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp

    r252520 r260732  
    5252    String messageString = message.isUndefined() ? String() : message.toWTFString(globalObject);
    5353    RETURN_IF_EXCEPTION(scope, encodedJSValue());
    54     auto* structure = InternalFunction::createSubclassStructure(globalObject, callFrame->jsCallee(), callFrame->newTarget(), globalObject->webAssemblyRuntimeErrorStructure());
    55     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     54
     55    JSObject* newTarget = asObject(callFrame->newTarget());
     56    Structure* structure = newTarget == callFrame->jsCallee()
     57        ? globalObject->webAssemblyRuntimeErrorStructure()
     58        : InternalFunction::createSubclassStructure(globalObject, newTarget, getFunctionRealm(vm, newTarget)->webAssemblyRuntimeErrorStructure());
     59    RETURN_IF_EXCEPTION(scope, { });
     60
    5661    return JSValue::encode(JSWebAssemblyRuntimeError::create(globalObject, vm, structure, WTFMove(messageString)));
    5762}

  • trunk/Source/WebCore/ChangeLog

    r260731 r260732  
     12020-04-26  Alexey Shvayka  <shvaikalesh@gmail.com>
     2
     3        InternalFunction::createSubclassStructure should use newTarget's globalObject
     4        https://bugs.webkit.org/show_bug.cgi?id=202599
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        Accounts for InternalFunction::createSubclassStructure() signature change and
     9        utilizes getFunctionRealm() helper to handle cross-realm JSBoundFunction and
     10        ProxyObject instances as NewTarget value.
     11
     12        Tests: web-platform-tests/WebIDL/ecmascript-binding/constructors.html
     13               web-platform-tests/custom-elements/htmlconstructor/newtarget.html
     14
     15        * bindings/js/JSDOMWrapperCache.h:
     16        (WebCore::setSubclassStructureIfNeeded):
     17        * bindings/js/JSHTMLElementCustom.cpp:
     18        (WebCore::constructJSHTMLElement):
     19
    1202020-04-26  Yusuke Suzuki  <ysuzuki@apple.com>
    221

  • trunk/Source/WebCore/bindings/js/JSDOMWrapperCache.h

    r256716 r260732  
    214214    auto scope = DECLARE_THROW_SCOPE(vm);
    215215
    216     auto* newTargetGlobalObject = JSC::jsCast<JSDOMGlobalObject*>(newTarget->globalObject(vm));
     216    auto* newTargetGlobalObject = JSC::jsCast<JSDOMGlobalObject*>(JSC::getFunctionRealm(vm, newTarget));
    217217    auto* baseStructure = getDOMStructure<WrapperClass>(vm, *newTargetGlobalObject);
    218     auto* subclassStructure = JSC::InternalFunction::createSubclassStructure(lexicalGlobalObject, constructor, newTarget, baseStructure);
     218    auto* subclassStructure = JSC::InternalFunction::createSubclassStructure(lexicalGlobalObject, newTarget, baseStructure);
    219219    RETURN_IF_EXCEPTION(scope, void());
    220220    jsObject->setStructure(vm, subclassStructure);

  • trunk/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp

    r251425 r260732  
    5555    ASSERT(context->isDocument());
    5656
    57     JSValue newTargetValue = callFrame.thisValue();
    58     auto* newTarget = newTargetValue.getObject();
    59     auto* newTargetGlobalObject = jsCast<JSDOMGlobalObject*>(newTarget->globalObject(vm));
     57    auto* newTarget = callFrame.newTarget().getObject();
     58    auto* newTargetGlobalObject = jsCast<JSDOMGlobalObject*>(getFunctionRealm(vm, newTarget));
    6059    JSValue htmlElementConstructorValue = JSHTMLElement::getConstructor(vm, newTargetGlobalObject);
    61     if (newTargetValue == htmlElementConstructorValue)
     60    if (newTarget == htmlElementConstructorValue)
    6261        return throwVMTypeError(lexicalGlobalObject, scope, "new.target is not a valid custom element constructor"_s);
    6362
    … …  
    7877    if (!elementInterface->isUpgradingElement()) {
    7978        Structure* baseStructure = getDOMStructure<JSHTMLElement>(vm, *newTargetGlobalObject);
    80         auto* newElementStructure = InternalFunction::createSubclassStructure(lexicalGlobalObject, jsConstructor, newTargetValue, baseStructure);
    81         RETURN_IF_EXCEPTION(scope, encodedJSValue());
     79        auto* newElementStructure = InternalFunction::createSubclassStructure(lexicalGlobalObject, newTarget, baseStructure);
     80        RETURN_IF_EXCEPTION(scope, { });
    8281
    8382        Ref<HTMLElement> element = HTMLElement::create(elementInterface->name(), document);
Note: See TracChangeset for help on using the changeset viewer.