Diff
Modified: trunk/JSTests/ChangeLog (216890 => 216891)
--- trunk/JSTests/ChangeLog 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/JSTests/ChangeLog 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,3 +1,13 @@
+2017-05-15 Mark Lam <mark....@apple.com>
+
+ Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
+ https://bugs.webkit.org/show_bug.cgi?id=172147
+
+ Rubber-stamped by Saam Barati.
+
+ * stress/object-rest-deconstruct.js: Removed.
+ * stress/object-spread.js: Removed.
+
2017-05-11 JF Bastien <jfbast...@apple.com>
WebAssembly: stop supporting 0xD
Deleted: trunk/JSTests/stress/object-rest-deconstruct.js (216890 => 216891)
--- trunk/JSTests/stress/object-rest-deconstruct.js 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/JSTests/stress/object-rest-deconstruct.js 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,246 +0,0 @@
-let assert = (e) => {
- if (!e)
- throw Error("Bad assertion!");
-}
-
-let assertPropDescriptor = (restObj, prop) => {
- let desc = Object.getOwnPropertyDescriptor(restObj, prop);
- assert(desc.enumerable);
- assert(desc.writable);
- assert(desc.configurable);
-}
-
-// Base Case
-(() => {
- let obj = {x: 1, y: 2, a: 5, b: 3}
-
- let {a, b, ...rest} = obj;
-
- assert(a === 5);
- assert(b === 3);
-
- assert(rest.x === 1);
- assert(rest.y === 2);
-
- assertPropDescriptor(rest, 'x');
- assertPropDescriptor(rest, 'y');
-})();
-
-// Empty Object
-(() => {
- let obj = {}
-
- let {a, b, ...rest} = obj;
-
- assert(a === undefined);
- assert(b === undefined);
-
- assert(typeof rest === "object");
-})();
-
-// Number case
-(() => {
- let obj = 3;
-
- let {...rest} = obj;
-
- assert(typeof rest === "object");
-})();
-
-// String case
-(() => {
- let obj = "foo";
-
- let {...rest} = obj;
-
- assert(typeof rest === "object");
-})();
-
-// Symbol case
-(() => {
- let obj = Symbol("foo");
-
- let {...rest} = obj;
-
- assert(typeof rest === "object");
-})();
-
-// null case
-(() => {
- let obj = null;
-
- try {
- let {...rest} = obj;
- assert(false);
- } catch (e) {
- assert(e.message == "Right side of assignment cannot be destructured");
- }
-
-})();
-
-// undefined case
-(() => {
- let obj = undefined;
-
- try {
- let {...rest} = obj;
- assert(false);
- } catch (e) {
- assert(e.message == "Right side of assignment cannot be destructured");
- }
-
-})();
-
-// getter case
-(() => {
- let obj = {a: 3, b: 4};
- Object.defineProperty(obj, "x", { get: () => 3, enumerable: true });
-
- let {a, b, ...rest} = obj;
-
- assert(a === 3);
- assert(b === 4);
-
- assert(rest.x === 3);
- assertPropDescriptor(rest, 'x');
-})();
-
-// Skip non-enumerable case
-(() => {
- let obj = {a: 3, b: 4};
- Object.defineProperty(obj, "x", { value: 4, enumerable: false });
-
- let {...rest} = obj;
-
- assert(rest.a === 3);
- assert(rest.b === 4);
- assert(rest.x === undefined);
-})();
-
-// Don't copy descriptor case
-(() => {
- let obj = {};
- Object.defineProperty(obj, "a", { value: 3, configurable: false, enumerable: true });
- Object.defineProperty(obj, "b", { value: 4, writable: false, enumerable: true });
-
- let {...rest} = obj;
-
- assert(rest.a === 3);
- assert(rest.b === 4);
-
- assertPropDescriptor(rest, 'a');
- assertPropDescriptor(rest, 'b');
-})();
-
-// Nested base case
-(() => {
- let obj = {a: 1, b: 2, c: 3, d: 4, e: 5};
-
- let {a, b, ...{c, e}} = obj;
-
- assert(a === 1);
- assert(b === 2);
- assert(c === 3);
- assert(e === 5);
-})();
-
-// Nested rest case
-(() => {
- let obj = {a: 1, b: 2, c: 3, d: 4, e: 5};
-
- let {a, b, ...{c, ...rest}} = obj;
-
- assert(a === 1);
- assert(b === 2);
- assert(c === 3);
-
- assert(rest.d === 4);
- assert(rest.e === 5);
-})();
-
-// Destructuring Only Own Properties
-(() => {
- var o = Object.create({ x: 1, y: 2 });
- o.z = 3;
-
- var x, y, z;
-
- // Destructuring assignment allows nested objects
- ({ x, ...{y , z} } = o);
-
- assert(x === 1);
- assert(y === undefined);
- assert(z === 3);
-})();
-
-// Destructuring function parameter
-
-(() => {
-
- var o = { x: 1, y: 2, w: 3, z: 4 };
-
- function foo({ x, y, ...rest }) {
- assert(x === 1);
- assert(y === 2);
- assert(rest.w === 3);
- assert(rest.z === 4);
- }
- foo(o);
-})();
-
-// Destructuring arrow function parameter
-
-(() => {
-
- var o = { x: 1, y: 2, w: 3, z: 4 };
-
- (({ x, y, ...rest }) => {
- assert(x === 1);
- assert(y === 2);
- assert(rest.w === 3);
- assert(rest.z === 4);
- })(o);
-})();
-
-// Destructuring to a property
-(() => {
-
- var o = { x: 1, y: 2};
-
- let settedValue;
- let src = ""
- ({...src.y} = o);
- assert(src.y.x === 1);
- assert(src.y.y === 2);
-})();
-
-// Destructuring with setter
-(() => {
-
- var o = { x: 1, y: 2};
-
- let settedValue;
- let src = {
- get y() { throw Error("The property should not be accessed"); },
- set y(v) {
- settedValue = v;
- }
- }
- src.y = undefined;
- ({...src.y} = o);
- assert(settedValue.x === 1);
- assert(settedValue.y === 2);
-})();
-
-// Destructuring yield
-(() => {
-
- var o = { x: 1, y: 2, w: 3, z: 4 };
-
- let gen = (function * (o) {
- ({...{ x = yield }} = o);
- })(o);
-
- assert(gen.next().value === undefined);
-})();
-
Deleted: trunk/JSTests/stress/object-spread.js (216890 => 216891)
--- trunk/JSTests/stress/object-spread.js 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/JSTests/stress/object-spread.js 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,297 +0,0 @@
-let assert = (a) => {
- if (!a)
- throw new Error("Bad Assertion");
-}
-
-assert.sameValue = (a, b) => {
- assert(a === b);
-}
-
-function validatePropertyDescriptor(o, p) {
- let desc = Object.getOwnPropertyDescriptor(o, p);
-
- assert(desc.enumerable);
- assert(desc.configurable);
- assert(desc.writable);
-}
-
-// Base cases
-
-(() => {
- let obj = {a: 1, b: 2, ...{c: 3, d: 4}};
-
- assert.sameValue(obj.a, 1);
- assert(obj.b, 2);
- assert(obj.c, 3);
- assert(obj.d, 4);
- validatePropertyDescriptor(obj, "c");
- validatePropertyDescriptor(obj, "d");
- assert(Object.keys(obj), 2);
-})();
-
-(() => {
- let o = {c: 3, d: 4};
- let obj = {a: 1, b: 2, ...o};
-
- assert.sameValue(obj.a, 1);
- assert.sameValue(obj.b, 2);
- assert.sameValue(obj.c, 3);
- assert.sameValue(obj.d, 4);
- assert.sameValue(Object.keys(obj).length, 4);
-
- validatePropertyDescriptor(obj, "a");
- validatePropertyDescriptor(obj, "b");
- validatePropertyDescriptor(obj, "c");
- validatePropertyDescriptor(obj, "d");
-})();
-
-(() => {
- let o = {a: 2, b: 3};
- let o2 = {c: 4, d: 5};
-
- let obj = {...o, ...o2};
-
- assert.sameValue(obj.a, 2);
- assert.sameValue(obj.b, 3);
- assert.sameValue(obj.c, 4);
- assert.sameValue(obj.d, 5);
- assert.sameValue(Object.keys(obj).length, 4);
-})();
-
-// Empty case
-
-(() => {
- let obj = {a: 1, b: 2, ...{}};
-
- assert.sameValue(obj.a, 1);
- assert.sameValue(obj.b, 2);
- assert.sameValue(Object.keys(obj).length, 2);
-})();
-
-// Ignoring cases
-
-(() => {
- let obj = {a: 1, ...null, b: 2, ...undefined, c: 3, ...{}, ...{...{}}, d: 4};
-
- assert.sameValue(obj.a, 1);
- assert.sameValue(obj.b, 2);
- assert.sameValue(obj.c, 3);
- assert.sameValue(obj.d, 4);
-
- let keys = Object.keys(obj);
- assert.sameValue(keys[0], "a");
- assert.sameValue(keys[1], "b");
- assert.sameValue(keys[2], "c");
- assert.sameValue(keys[3], "d");
-})();
-
-// Null case
-
-(() => {
- let obj = {a: 1, b: 2, ...null};
-
- assert.sameValue(obj.a, 1);
- assert.sameValue(obj.b, 2);
- assert.sameValue(Object.keys(obj).length, 2);
-})();
-
-(() => {
- let obj = {...null};
-
- assert.sameValue(Object.keys(obj).length, 0);
-})();
-
-// Undefined case
-
-(() => {
- let obj = {a: 1, b: 2, ...undefined};
-
- assert.sameValue(obj.a, 1);
- assert.sameValue(obj.b, 2);
- assert.sameValue(Object.keys(obj).length, 2);
-})();
-
-(() => {
- let obj = {...undefined};
-
- assert.sameValue(Object.keys(obj).length, 0);
-})();
-
-// Getter case
-
-(() => {
- let o = {
- get a() {
- return 42;
- }
- };
-
- let obj = {...o, c: 4, d: 5};
-
- assert.sameValue(Object.getOwnPropertyDescriptor(obj, "a").value, 42);
- assert.sameValue(obj.c, 4);
- assert.sameValue(obj.d, 5);
- assert.sameValue(Object.keys(obj).length, 3);
-
- validatePropertyDescriptor(obj, "a");
-})();
-
-(() => {
- let o = {a: 2, b: 3}
- let executedGetter = false;
-
- let obj = {...o, get c() { executedGetter = true; }};
-
- assert.sameValue(obj.a, 2);
- assert.sameValue(obj.b, 3);
- assert.sameValue(executedGetter, false)
- assert.sameValue(Object.keys(obj).length, 3);
-})();
-
-(() => {
- let getterCallCount = 0;
- let o = {
- get a() {
- return ++getterCallCount;
- }
- };
-
- let obj = {...o, c: 4, d: 5, a: 42, ...o};
-
- assert.sameValue(obj.a, 2);
- assert.sameValue(obj.c, 4);
- assert.sameValue(obj.d, 5);
- assert.sameValue(Object.keys(obj).length, 3);
-})();
-
-// Manipulate Object case
-
-(() => {
- var o = { a: 0, b: 1 };
- var cthulhu = { get x() {
- delete o.a;
- o.b = 42;
- o.c = "ni";
- }};
-
- let obj = {...cthulhu, ...o};
-
- assert.sameValue(obj.hasOwnProperty("a"), false);
- assert.sameValue(obj.b, 42);
- assert.sameValue(obj.c, "ni");
- assert(obj.hasOwnProperty("x"));
- assert.sameValue(Object.keys(obj).length, 3);
-})();
-
-// Override
-
-(() => {
- let o = {a: 2, b: 3};
-
- let obj = {a: 1, b: 7, ...o};
-
- assert.sameValue(obj.a, 2);
- assert.sameValue(obj.b, 3);
- assert.sameValue(Object.keys(obj).length, 2);
- assert.sameValue(o.a, 2);
- assert.sameValue(o.b, 3);
-})();
-
-(() => {
- let o = {a: 2, b: 3, c: 4, e: undefined, f: null, g: false};
-
- let obj = {...o, a: 1, b: 7, d: 5, h: -0, i: Symbol("foo"), j: o};
-
- assert.sameValue(obj.a, 1);
- assert.sameValue(obj.b, 7);
- assert.sameValue(obj.c, 4);
- assert.sameValue(obj.d, 5);
- assert(obj.hasOwnProperty("e"));
- assert.sameValue(obj.f, null);
- assert.sameValue(obj.g, false);
- assert.sameValue(obj.h, -0);
- assert.sameValue(obj.i.toString(), "Symbol(foo)");
- assert(Object.is(obj.j, o));
- assert.sameValue(Object.keys(obj).length, 10);
-})();
-
-// Override Immutable
-
-(() => {
- let o = {b: 2};
- Object.defineProperty(o, "a", {value: 1, enumerable: true, writable: false, configurable: true});
-
- let obj = {...o, a: 3};
-
- assert.sameValue(obj.a, 3)
- assert.sameValue(obj.b, 2);
- validatePropertyDescriptor(obj, "a");
- validatePropertyDescriptor(obj, "b");
-})();
-
-// Setter
-
-(() => {
- let executedSetter = false;
-
- let obj = {set c(v) { executedSetter = true; }, ...{c: 1}};
-
- assert.sameValue(obj.c, 1);
- assert.sameValue(executedSetter, false);
- assert.sameValue(Object.keys(obj).length, 1);
-})();
-
-// Skip non-enumerble
-
-(() => {
- let o = {};
- Object.defineProperty(o, "b", {value: 3, enumerable: false});
-
- let obj = {...o};
-
- assert.sameValue(obj.hasOwnProperty("b"), false)
- assert.sameValue(Object.keys(obj).length, 0);
-})();
-
-// Spread order
-
-(() => {
- var calls = []
- var o = { get z() { calls.push('z') }, get a() { calls.push('a') } };
- Object.defineProperty(o, 1, { get: () => { calls.push(1) }, enumerable: true });
- Object.defineProperty(o, Symbol('foo'), { get: () => { calls.push("Symbol(foo)") }, enumerable: true });
-
- let obj = {...o};
-
- assert.sameValue(calls[0], 1);
- assert.sameValue(calls[1], "z");
- assert.sameValue(calls[2], "a");
- assert.sameValue(calls[3], "Symbol(foo)");
- assert.sameValue(Object.keys(obj).length, 3);
-})();
-
-// Symbol property
-(() => {
- let symbol = Symbol('foo');
- let o = {};
- o[symbol] = 1;
-
- let obj = {...o, c: 4, d: 5};
-
- assert.sameValue(obj[symbol], 1);
- assert.sameValue(obj.c, 4);
- assert.sameValue(obj.d, 5);
- assert.sameValue(Object.keys(obj).length, 2);
-})();
-
-// Getter throw
-
-(() => {
- try {
- let obj = {...{ get foo() { throw new Error("Getter Exception"); } }};
- assert(false);
- } catch(e) {
- assert.sameValue(e.message, "Getter Exception");
- }
-})();
-
Modified: trunk/LayoutTests/ChangeLog (216890 => 216891)
--- trunk/LayoutTests/ChangeLog 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/LayoutTests/ChangeLog 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,3 +1,13 @@
+2017-05-15 Mark Lam <mark....@apple.com>
+
+ Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
+ https://bugs.webkit.org/show_bug.cgi?id=172147
+
+ Rubber-stamped by Saam Barati.
+
+ * js/parser-syntax-check-expected.txt:
+ * js/script-tests/parser-syntax-check.js:
+
2017-05-15 Chris Dumez <cdu...@apple.com>
Unreviewed, rebaseline platform/ios/ios/css/construct-WebKitCSSMatrix.html after r216881.
Modified: trunk/LayoutTests/js/parser-syntax-check-expected.txt (216890 => 216891)
--- trunk/LayoutTests/js/parser-syntax-check-expected.txt 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/LayoutTests/js/parser-syntax-check-expected.txt 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1167,46 +1167,8 @@
PASS Valid: "function f() { var {x: [y, {z: {z: [...z]}}]} = 20 }"
PASS Invalid: "var [...y, ...z] = 20". Produced the following syntax error: "SyntaxError: Unexpected token ','. Expected a closing ']' following a rest element destructuring pattern."
PASS Invalid: "function f() { var [...y, ...z] = 20 }". Produced the following syntax error: "SyntaxError: Unexpected token ','. Expected a closing ']' following a rest element destructuring pattern."
-PASS Valid: "var [...{...y}] = 20" with TypeError
-PASS Valid: "function f() { var [...{...y}] = 20 }"
-PASS Valid: "var {a, b, ...r} = {a: 1, b: 2, c: 3};"
-PASS Valid: "function f() { var {a, b, ...r} = {a: 1, b: 2, c: 3}; }"
-PASS Valid: "var {a, b, ...{d}} = {a: 1, b: 2, c: 3, d: 4};"
-PASS Valid: "function f() { var {a, b, ...{d}} = {a: 1, b: 2, c: 3, d: 4}; }"
-PASS Valid: "var {a, b, ...{d = 15}} = {a: 1, b: 2, c: 3, d: 4};"
-PASS Valid: "function f() { var {a, b, ...{d = 15}} = {a: 1, b: 2, c: 3, d: 4}; }"
-PASS Valid: "var {a, b, ...{d = 15, ...r}} = {a: 1, b: 2, c: 3, d: 4};"
-PASS Valid: "function f() { var {a, b, ...{d = 15, ...r}} = {a: 1, b: 2, c: 3, d: 4}; }"
-PASS Valid: "(({a, b, ...r}) => {})({a: 1, b: 2, c: 3, d: 4});"
-PASS Valid: "function f() { (({a, b, ...r}) => {})({a: 1, b: 2, c: 3, d: 4}); }"
-PASS Valid: "(function ({a, b, ...r}) {})({a: 1, b: 2, c: 3, d: 4});"
-PASS Valid: "function f() { (function ({a, b, ...r}) {})({a: 1, b: 2, c: 3, d: 4}); }"
-PASS Valid: "var a, b, c; ({a, b, ...r} = {a: 1, b: 2, c: 3, d: 4});"
-PASS Valid: "function f() { var a, b, c; ({a, b, ...r} = {a: 1, b: 2, c: 3, d: 4}); }"
-PASS Valid: "function * foo(o) { ({...{ x = yield }} = o); }"
-PASS Valid: "function f() { function * foo(o) { ({...{ x = yield }} = o); } }"
-PASS Valid: "let c = {}; let o = {a: 1, b: 2, ...c};"
-PASS Valid: "function f() { let c = {}; let o = {a: 1, b: 2, ...c}; }"
-PASS Valid: "let o = {a: 1, b: 3, ...{}};"
-PASS Valid: "function f() { let o = {a: 1, b: 3, ...{}}; }"
-PASS Valid: "let o = {a: 1, b: 2, ...null, c: 3};"
-PASS Valid: "function f() { let o = {a: 1, b: 2, ...null, c: 3}; }"
-PASS Valid: "let o = {a: 1, b: 2, ...undefined, c: 3};"
-PASS Valid: "function f() { let o = {a: 1, b: 2, ...undefined, c: 3}; }"
-PASS Valid: "let o = {a: 1, b: 2, ...{...{}}, c: 3};"
-PASS Valid: "function f() { let o = {a: 1, b: 2, ...{...{}}, c: 3}; }"
-PASS Valid: "let c = {}; let o = {a: 1, b: 2, ...c, d: 3, ...c, e: 5};"
-PASS Valid: "function f() { let c = {}; let o = {a: 1, b: 2, ...c, d: 3, ...c, e: 5}; }"
-PASS Valid: "function* gen() { yield {a: 1, b: 2, ...yield yield, d: 3, ...yield, e: 5}; }"
-PASS Valid: "function f() { function* gen() { yield {a: 1, b: 2, ...yield yield, d: 3, ...yield, e: 5}; } }"
-PASS Invalid: "var {...r = {a: 2}} = {a: 1, b: 2};". Produced the following syntax error: "SyntaxError: Unexpected token '='. Expected a closing '}' following a rest element destructuring pattern."
-PASS Invalid: "function f() { var {...r = {a: 2}} = {a: 1, b: 2}; }". Produced the following syntax error: "SyntaxError: Unexpected token '='. Expected a closing '}' following a rest element destructuring pattern."
-PASS Invalid: "var {...r, b} = {a: 1, b: 2};". Produced the following syntax error: "SyntaxError: Unexpected token ','. Expected a closing '}' following a rest element destructuring pattern."
-PASS Invalid: "function f() { var {...r, b} = {a: 1, b: 2}; }". Produced the following syntax error: "SyntaxError: Unexpected token ','. Expected a closing '}' following a rest element destructuring pattern."
-PASS Invalid: "var {...r, ...e} = {a: 1, b: 2};". Produced the following syntax error: "SyntaxError: Unexpected token ','. Expected a closing '}' following a rest element destructuring pattern."
-PASS Invalid: "function f() { var {...r, ...e} = {a: 1, b: 2}; }". Produced the following syntax error: "SyntaxError: Unexpected token ','. Expected a closing '}' following a rest element destructuring pattern."
-PASS Invalid: "function * (o) { ({ ...{ x: yield } } = o); }". Produced the following syntax error: "SyntaxError: Unexpected token '('"
-PASS Invalid: "function f() { function * (o) { ({ ...{ x: yield } } = o); } }". Produced the following syntax error: "SyntaxError: Unexpected token '('"
+PASS Invalid: "var [...{...y}] = 20". Produced the following syntax error: "SyntaxError: Unexpected token '...'. Expected a property name."
+PASS Invalid: "function f() { var [...{...y}] = 20 }". Produced the following syntax error: "SyntaxError: Unexpected token '...'. Expected a property name."
Rest parameter
PASS Valid: "function foo(...a) { }"
PASS Valid: "function f() { function foo(...a) { } }"
@@ -1274,8 +1236,8 @@
PASS Valid: "function f() { let x = (a = 20, ...[...[b = 40]]) => { } }"
PASS Valid: "let x = (a = 20, ...{b}) => { }"
PASS Valid: "function f() { let x = (a = 20, ...{b}) => { } }"
-PASS Valid: "let x = (a = 20, ...{...b}) => { }"
-PASS Valid: "function f() { let x = (a = 20, ...{...b}) => { } }"
+PASS Invalid: "let x = (a = 20, ...{...b}) => { }". Produced the following syntax error: "SyntaxError: Unexpected token '...'"
+PASS Invalid: "function f() { let x = (a = 20, ...{...b}) => { } }". Produced the following syntax error: "SyntaxError: Unexpected token '...'"
PASS Invalid: "let x = (a = 20, ...{124}) => { }". Produced the following syntax error: "SyntaxError: Unexpected token '...'"
PASS Invalid: "function f() { let x = (a = 20, ...{124}) => { } }". Produced the following syntax error: "SyntaxError: Unexpected token '...'"
non-simple parameter list
Modified: trunk/LayoutTests/js/script-tests/parser-syntax-check.js (216890 => 216891)
--- trunk/LayoutTests/js/script-tests/parser-syntax-check.js 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/LayoutTests/js/script-tests/parser-syntax-check.js 2017-05-16 00:21:59 UTC (rev 216891)
@@ -691,26 +691,7 @@
valid("var {x: [y, ...[...[...{z: [...z]}]]]} = 20");
valid("var {x: [y, {z: {z: [...z]}}]} = 20");
invalid("var [...y, ...z] = 20");
-valid("var [...{...y}] = 20");
-valid("var {a, b, ...r} = {a: 1, b: 2, c: 3};");
-valid("var {a, b, ...{d}} = {a: 1, b: 2, c: 3, d: 4};");
-valid("var {a, b, ...{d = 15}} = {a: 1, b: 2, c: 3, d: 4};");
-valid("var {a, b, ...{d = 15, ...r}} = {a: 1, b: 2, c: 3, d: 4};");
-valid("(({a, b, ...r}) => {})({a: 1, b: 2, c: 3, d: 4});");
-valid("(function ({a, b, ...r}) {})({a: 1, b: 2, c: 3, d: 4});");
-valid("var a, b, c; ({a, b, ...r} = {a: 1, b: 2, c: 3, d: 4});");
-valid("function * foo(o) { ({...{ x = yield }} = o); }");
-valid("let c = {}; let o = {a: 1, b: 2, ...c};");
-valid("let o = {a: 1, b: 3, ...{}};");
-valid("let o = {a: 1, b: 2, ...null, c: 3};");
-valid("let o = {a: 1, b: 2, ...undefined, c: 3};");
-valid("let o = {a: 1, b: 2, ...{...{}}, c: 3};");
-valid("let c = {}; let o = {a: 1, b: 2, ...c, d: 3, ...c, e: 5};");
-valid("function* gen() { yield {a: 1, b: 2, ...yield yield, d: 3, ...yield, e: 5}; }");
-invalid("var {...r = {a: 2}} = {a: 1, b: 2};");
-invalid("var {...r, b} = {a: 1, b: 2};");
-invalid("var {...r, ...e} = {a: 1, b: 2};");
-invalid("function * (o) { ({ ...{ x: yield } } = o); }");
+invalid("var [...{...y}] = 20");
debug("Rest parameter");
valid("function foo(...a) { }");
@@ -746,7 +727,7 @@
valid("let x = (a = 20, ...[...b]) => { }");
valid("let x = (a = 20, ...[...[b = 40]]) => { }");
valid("let x = (a = 20, ...{b}) => { }");
-valid("let x = (a = 20, ...{...b}) => { }");
+invalid("let x = (a = 20, ...{...b}) => { }");
invalid("let x = (a = 20, ...{124}) => { }");
debug("non-simple parameter list")
Modified: trunk/Source/_javascript_Core/ChangeLog (216890 => 216891)
--- trunk/Source/_javascript_Core/ChangeLog 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,3 +1,61 @@
+2017-05-15 Mark Lam <mark....@apple.com>
+
+ Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
+ https://bugs.webkit.org/show_bug.cgi?id=172147
+
+ Rubber-stamped by Saam Barati.
+
+ I rolled out every thing in those 2 patches except for the change to make
+ CodeBlock::finishCreation() return a bool plus its clients that depend on this.
+ I made this exception because r214931 relies on this change, and this part of
+ the change looks correct.
+
+ * builtins/BuiltinNames.h:
+ * builtins/GlobalOperations.js:
+ (globalPrivate.speciesConstructor):
+ (globalPrivate.copyDataProperties): Deleted.
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::finishCreation):
+ (JSC::CodeBlock::setConstantIdentifierSetRegisters): Deleted.
+ * bytecode/CodeBlock.h:
+ * bytecode/UnlinkedCodeBlock.h:
+ (JSC::UnlinkedCodeBlock::addBitVector):
+ (JSC::UnlinkedCodeBlock::constantRegisters):
+ (JSC::UnlinkedCodeBlock::addSetConstant): Deleted.
+ (JSC::UnlinkedCodeBlock::constantIdentifierSets): Deleted.
+ * bytecompiler/BytecodeGenerator.cpp:
+ * bytecompiler/BytecodeGenerator.h:
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::PropertyListNode::emitBytecode):
+ (JSC::ObjectPatternNode::bindValue):
+ (JSC::ObjectSpreadExpressionNode::emitBytecode): Deleted.
+ * parser/ASTBuilder.h:
+ (JSC::ASTBuilder::createProperty):
+ (JSC::ASTBuilder::appendObjectPatternEntry):
+ (JSC::ASTBuilder::createObjectSpreadExpression): Deleted.
+ (JSC::ASTBuilder::appendObjectPatternRestEntry): Deleted.
+ (JSC::ASTBuilder::setContainsObjectRestElement): Deleted.
+ * parser/NodeConstructors.h:
+ (JSC::PropertyNode::PropertyNode):
+ (JSC::SpreadExpressionNode::SpreadExpressionNode):
+ (JSC::ObjectSpreadExpressionNode::ObjectSpreadExpressionNode): Deleted.
+ * parser/Nodes.h:
+ (JSC::ObjectPatternNode::appendEntry):
+ (JSC::ObjectSpreadExpressionNode::_expression_): Deleted.
+ (JSC::ObjectPatternNode::setContainsRestElement): Deleted.
+ * parser/Parser.cpp:
+ (JSC::Parser<LexerType>::parseDestructuringPattern):
+ (JSC::Parser<LexerType>::parseProperty):
+ * parser/SyntaxChecker.h:
+ (JSC::SyntaxChecker::createSpreadExpression):
+ (JSC::SyntaxChecker::createProperty):
+ (JSC::SyntaxChecker::operatorStackPop):
+ (JSC::SyntaxChecker::createObjectSpreadExpression): Deleted.
+ * runtime/ObjectConstructor.cpp:
+ (JSC::ObjectConstructor::finishCreation):
+ * runtime/SetPrototype.cpp:
+ (JSC::SetPrototype::finishCreation):
+
2017-05-15 David Kilzer <ddkil...@apple.com>
JSEnvironmentRecord::allocationSizeForScopeSize() and offsetOfVariable(ScopeOffset) should used checked arithmetic
Modified: trunk/Source/_javascript_Core/builtins/BuiltinNames.h (216890 => 216891)
--- trunk/Source/_javascript_Core/builtins/BuiltinNames.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/builtins/BuiltinNames.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -159,7 +159,6 @@
macro(stringIncludesInternal) \
macro(stringSplitFast) \
macro(stringSubstrInternal) \
- macro(toObject) \
macro(makeBoundFunction) \
macro(hasOwnLengthProperty) \
macro(importModule) \
Modified: trunk/Source/_javascript_Core/builtins/GlobalOperations.js (216890 => 216891)
--- trunk/Source/_javascript_Core/builtins/GlobalOperations.js 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/builtins/GlobalOperations.js 2017-05-16 00:21:59 UTC (rev 216891)
@@ -79,29 +79,3 @@
return constructor;
@throwTypeError("|this|.constructor[Symbol.species] is not a constructor");
}
-
-@globalPrivate
-function copyDataProperties(target, source, excludedSet)
-{
- if (!@isObject(target))
- @throwTypeError("target needs to be an object");
-
- if (source == null)
- return target;
-
- let from = @Object(source);
- let keys = @Reflect.@ownKeys(from);
- let keysLength = keys.length;
- for (let i = 0; i < keysLength; i++) {
- let nextKey = keys[i];
- if (!excludedSet.@has(nextKey)) {
- let desc = @Object.@getOwnPropertyDescriptor(from, nextKey);
- if (desc.enumerable && desc !== @undefined) {
- let propValue = from[nextKey];
- @Object.@defineProperty(target, nextKey, {value: propValue, enumerable: true, writable: true, configurable: true});
- }
- }
- }
-
- return target;
-}
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp (216890 => 216891)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp 2017-05-16 00:21:59 UTC (rev 216891)
@@ -58,8 +58,6 @@
#include "JSFunction.h"
#include "JSLexicalEnvironment.h"
#include "JSModuleEnvironment.h"
-#include "JSSet.h"
-#include "JSString.h"
#include "JSTemplateRegistryKey.h"
#include "LLIntData.h"
#include "LLIntEntrypoint.h"
@@ -407,8 +405,6 @@
if (!setConstantRegisters(unlinkedCodeBlock->constantRegisters(), unlinkedCodeBlock->constantsSourceCodeRepresentation()))
return false;
- if (!setConstantIdentifierSetRegisters(vm, unlinkedCodeBlock->constantIdentifierSets()))
- return false;
if (unlinkedCodeBlock->usesGlobalObject())
m_constantRegisters[unlinkedCodeBlock->globalObjectRegister().toConstantIndex()].set(*m_vm, this, m_globalObject.get());
@@ -867,29 +863,6 @@
#endif // ENABLE(JIT)
}
-bool CodeBlock::setConstantIdentifierSetRegisters(VM& vm, const Vector<ConstantIndentifierSetEntry>& constants)
-{
- auto scope = DECLARE_THROW_SCOPE(vm);
- JSGlobalObject* globalObject = m_globalObject.get();
- ExecState* exec = globalObject->globalExec();
-
- for (const auto& entry : constants) {
- Structure* setStructure = globalObject->setStructure();
- RETURN_IF_EXCEPTION(scope, false);
- JSSet* jsSet = JSSet::create(exec, vm, setStructure);
- RETURN_IF_EXCEPTION(scope, false);
-
- const IdentifierSet& set = entry.first;
- for (auto& setEntry : set) {
- JSString* jsString = jsOwnedString(&vm, setEntry.get());
- jsSet->add(exec, JSValue(jsString));
- RETURN_IF_EXCEPTION(scope, false);
- }
- m_constantRegisters[entry.second].set(vm, this, JSValue(jsSet));
- }
- return true;
-}
-
bool CodeBlock::setConstantRegisters(const Vector<WriteBarrier<Unknown>>& constants, const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation)
{
auto scope = DECLARE_THROW_SCOPE(*m_vm);
Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.h (216890 => 216891)
--- trunk/Source/_javascript_Core/bytecode/CodeBlock.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -920,8 +920,6 @@
void updateAllPredictionsAndCountLiveness(unsigned& numberOfLiveNonArgumentValueProfiles, unsigned& numberOfSamplesInProfiles);
- bool setConstantIdentifierSetRegisters(VM&, const Vector<ConstantIndentifierSetEntry>& constants);
-
bool setConstantRegisters(const Vector<WriteBarrier<Unknown>>& constants, const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation);
void replaceConstant(int index, JSValue value)
Modified: trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.h (216890 => 216891)
--- trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -41,12 +41,9 @@
#include "UnlinkedFunctionExecutable.h"
#include "VariableEnvironment.h"
#include "VirtualRegister.h"
-#include <algorithm>
#include <wtf/BitVector.h>
-#include <wtf/HashSet.h>
#include <wtf/TriState.h>
#include <wtf/Vector.h>
-#include <wtf/text/UniquedStringImpl.h>
namespace JSC {
@@ -68,7 +65,6 @@
typedef unsigned UnlinkedArrayAllocationProfile;
typedef unsigned UnlinkedObjectAllocationProfile;
typedef unsigned UnlinkedLLIntCallLinkInfo;
-typedef std::pair<IdentifierSet, unsigned> ConstantIndentifierSetEntry;
struct UnlinkedStringJumpTable {
struct OffsetLocation {
@@ -186,16 +182,6 @@
m_bitVectors.append(WTFMove(bitVector));
return m_bitVectors.size() - 1;
}
-
- void addSetConstant(IdentifierSet& set)
- {
- VM& vm = *this->vm();
- auto locker = lockDuringMarking(vm.heap, *this);
- unsigned result = m_constantRegisters.size();
- m_constantRegisters.append(WriteBarrier<Unknown>());
- m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
- m_constantIdentifierSets.append(ConstantIndentifierSetEntry(set, result));
- }
unsigned addConstant(JSValue v, SourceCodeRepresentation sourceCodeRepresentation = SourceCodeRepresentation::Other)
{
@@ -228,7 +214,6 @@
return m_linkTimeConstants[index];
}
const Vector<WriteBarrier<Unknown>>& constantRegisters() { return m_constantRegisters; }
- const Vector<ConstantIndentifierSetEntry>& constantIdentifierSets() { return m_constantIdentifierSets; }
const WriteBarrier<Unknown>& constantRegister(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].get(); }
@@ -462,7 +447,6 @@
Vector<Identifier> m_identifiers;
Vector<BitVector> m_bitVectors;
Vector<WriteBarrier<Unknown>> m_constantRegisters;
- Vector<ConstantIndentifierSetEntry> m_constantIdentifierSets;
Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation;
typedef Vector<WriteBarrier<UnlinkedFunctionExecutable>> FunctionExpressionVector;
FunctionExpressionVector m_functionDecls;
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (216890 => 216891)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1951,27 +1951,6 @@
return constantID;
}
-RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, IdentifierSet& set)
-{
- for (const auto& entry : m_codeBlock->constantIdentifierSets()) {
- if (entry.first != set)
- continue;
-
- return &m_constantPoolRegisters[entry.second];
- }
-
- unsigned index = m_nextConstantOffset;
- m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
- ++m_nextConstantOffset;
- m_codeBlock->addSetConstant(set);
- RegisterID* m_setRegister = &m_constantPoolRegisters[index];
-
- if (dst)
- return emitMove(dst, m_setRegister);
-
- return m_setRegister;
-}
-
RegisterID* BytecodeGenerator::emitLoadGlobalObject(RegisterID* dst)
{
if (!m_globalObjectRegister) {
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h (216890 => 216891)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -587,7 +587,6 @@
RegisterID* emitLoad(RegisterID* dst, bool);
RegisterID* emitLoad(RegisterID* dst, const Identifier&);
RegisterID* emitLoad(RegisterID* dst, JSValue, SourceCodeRepresentation = SourceCodeRepresentation::Other);
- RegisterID* emitLoad(RegisterID* dst, IdentifierSet& excludedList);
RegisterID* emitLoadGlobalObject(RegisterID* dst);
RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src);
Modified: trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp (216890 => 216891)
--- trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2017-05-16 00:21:59 UTC (rev 216891)
@@ -41,10 +41,8 @@
#include "Parser.h"
#include "StackAlignment.h"
#include <wtf/Assertions.h>
-#include <wtf/HashSet.h>
#include <wtf/Threading.h>
#include <wtf/text/StringBuilder.h>
-#include <wtf/text/UniquedStringImpl.h>
using namespace WTF;
@@ -516,7 +514,7 @@
hasComputedProperty = true;
break;
}
- if (node->m_type & PropertyNode::Constant || node->m_type & PropertyNode::Spread)
+ if (node->m_type & PropertyNode::Constant)
continue;
// Duplicates are possible.
@@ -538,9 +536,6 @@
if (node->m_type & PropertyNode::Constant) {
emitPutConstantProperty(generator, dst, *node);
continue;
- } else if (node->m_type & PropertyNode::Spread) {
- generator.emitNode(dst, node->m_assign);
- continue;
}
RefPtr<RegisterID> value = generator.emitNode(node->m_assign);
@@ -4066,56 +4061,25 @@
void ObjectPatternNode::bindValue(BytecodeGenerator& generator, RegisterID* rhs) const
{
generator.emitRequireObjectCoercible(rhs, ASCIILiteral("Right side of assignment cannot be destructured"));
-
- IdentifierSet excludedSet;
-
for (const auto& target : m_targetPatterns) {
- if (target.bindingType == BindingType::Element) {
- RefPtr<RegisterID> temp = generator.newTemporary();
- if (!target.propertyExpression) {
-
- // Should not emit get_by_id for indexed ones.
- std::optional<uint32_t> optionalIndex = parseIndex(target.propertyName);
- if (!optionalIndex)
- generator.emitGetById(temp.get(), rhs, target.propertyName);
- else {
- RefPtr<RegisterID> pIndex = generator.emitLoad(nullptr, jsNumber(optionalIndex.value()));
- generator.emitGetByVal(temp.get(), rhs, pIndex.get());
- }
- } else {
- RefPtr<RegisterID> propertyName = generator.emitNode(target.propertyExpression);
- generator.emitGetByVal(temp.get(), rhs, propertyName.get());
+ RefPtr<RegisterID> temp = generator.newTemporary();
+ if (!target.propertyExpression) {
+ // Should not emit get_by_id for indexed ones.
+ std::optional<uint32_t> optionalIndex = parseIndex(target.propertyName);
+ if (!optionalIndex)
+ generator.emitGetById(temp.get(), rhs, target.propertyName);
+ else {
+ RefPtr<RegisterID> index = generator.emitLoad(nullptr, jsNumber(optionalIndex.value()));
+ generator.emitGetByVal(temp.get(), rhs, index.get());
}
-
- if (UNLIKELY(m_containsRestElement))
- excludedSet.add(target.propertyName.impl());
-
- if (target.defaultValue)
- assignDefaultValueIfUndefined(generator, temp.get(), target.defaultValue);
- target.pattern->bindValue(generator, temp.get());
} else {
- RefPtr<RegisterID> excludedSetReg = generator.emitLoad(generator.newTemporary(), excludedSet);
-
- RefPtr<RegisterID> newObject = generator.emitNewObject(generator.newTemporary());
-
- // load and call @copyDataProperties
- auto var = generator.variable(generator.propertyNames().builtinNames().copyDataPropertiesPrivateName());
-
- RefPtr<RegisterID> scope = generator.newTemporary();
- generator.moveToDestinationIfNeeded(scope.get(), generator.emitResolveScope(scope.get(), var));
- RefPtr<RegisterID> copyDataProperties = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
-
- CallArguments args(generator, nullptr, 3);
- unsigned argumentCount = 0;
- generator.emitLoad(args.thisRegister(), jsUndefined());
- generator.emitMove(args.argumentRegister(argumentCount++), newObject.get());
- generator.emitMove(args.argumentRegister(argumentCount++), rhs);
- generator.emitMove(args.argumentRegister(argumentCount++), excludedSetReg.get());
+ RefPtr<RegisterID> propertyName = generator.emitNode(target.propertyExpression);
+ generator.emitGetByVal(temp.get(), rhs, propertyName.get());
+ }
- RefPtr<RegisterID> result = generator.newTemporary();
- generator.emitCall(result.get(), copyDataProperties.get(), NoExpectedFunction, args, divot(), divotStart(), divotEnd(), DebuggableCall::No);
- target.pattern->bindValue(generator, result.get());
- }
+ if (target.defaultValue)
+ assignDefaultValueIfUndefined(generator, temp.get(), target.defaultValue);
+ target.pattern->bindValue(generator, temp.get());
}
}
@@ -4265,31 +4229,4 @@
return 0;
}
-RegisterID* ObjectSpreadExpressionNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
-{
- RefPtr<RegisterID> src = ""
- generator.emitNode(src.get(), m_expression);
- IdentifierSet excludedSet;
-
- RefPtr<RegisterID> excludedSetReg = generator.emitLoad(generator.newTemporary(), excludedSet);
-
- // load and call @copyDataProperties
- auto var = generator.variable(generator.propertyNames().builtinNames().copyDataPropertiesPrivateName());
-
- RefPtr<RegisterID> scope = generator.newTemporary();
- generator.moveToDestinationIfNeeded(scope.get(), generator.emitResolveScope(scope.get(), var));
- RefPtr<RegisterID> copyDataProperties = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
-
- CallArguments args(generator, nullptr, 3);
- unsigned argumentCount = 0;
- generator.emitLoad(args.thisRegister(), jsUndefined());
- generator.emitMove(args.argumentRegister(argumentCount++), dst);
- generator.emitMove(args.argumentRegister(argumentCount++), src.get());
- generator.emitMove(args.argumentRegister(argumentCount++), excludedSetReg.get());
-
- generator.emitCall(generator.newTemporary(), copyDataProperties.get(), NoExpectedFunction, args, divot(), divotStart(), divotEnd(), DebuggableCall::No);
-
- return 0;
-}
-
} // namespace JSC
Modified: trunk/Source/_javascript_Core/parser/ASTBuilder.h (216890 => 216891)
--- trunk/Source/_javascript_Core/parser/ASTBuilder.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/parser/ASTBuilder.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -275,13 +275,6 @@
return node;
}
- ExpressionNode* createObjectSpreadExpression(const JSTokenLocation& location, ExpressionNode* _expression_, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
- {
- auto node = new (m_parserArena) ObjectSpreadExpressionNode(location, _expression_);
- setExceptionLocation(node, start, divot, end);
- return node;
- }
-
TemplateStringNode* createTemplateString(const JSTokenLocation& location, const Identifier* cooked, const Identifier* raw)
{
return new (m_parserArena) TemplateStringNode(location, cooked, raw);
@@ -502,10 +495,6 @@
}
return new (m_parserArena) PropertyNode(*propertyName, node, type, putType, superBinding, isClassProperty);
}
- PropertyNode* createProperty(ExpressionNode* node, PropertyNode::Type type, PropertyNode::PutType putType, bool, SuperBinding superBinding, bool isClassProperty)
- {
- return new (m_parserArena) PropertyNode(node, type, putType, superBinding, isClassProperty);
- }
PropertyNode* createProperty(VM* vm, ParserArena& parserArena, double propertyName, ExpressionNode* node, PropertyNode::Type type, PropertyNode::PutType putType, bool, SuperBinding superBinding, bool isClassProperty)
{
return new (m_parserArena) PropertyNode(parserArena.identifierArena().makeNumericIdentifier(vm, propertyName), node, type, putType, superBinding, isClassProperty);
@@ -955,26 +944,16 @@
void appendObjectPatternEntry(ObjectPattern node, const JSTokenLocation& location, bool wasString, const Identifier& identifier, DestructuringPattern pattern, ExpressionNode* defaultValue)
{
- node->appendEntry(location, identifier, wasString, pattern, defaultValue, ObjectPatternNode::BindingType::Element);
+ node->appendEntry(location, identifier, wasString, pattern, defaultValue);
tryInferNameInPattern(pattern, defaultValue);
}
void appendObjectPatternEntry(ObjectPattern node, const JSTokenLocation& location, ExpressionNode* propertyExpression, DestructuringPattern pattern, ExpressionNode* defaultValue)
{
- node->appendEntry(location, propertyExpression, pattern, defaultValue, ObjectPatternNode::BindingType::Element);
+ node->appendEntry(location, propertyExpression, pattern, defaultValue);
tryInferNameInPattern(pattern, defaultValue);
}
-
- void appendObjectPatternRestEntry(ObjectPattern node, const JSTokenLocation& location, DestructuringPattern pattern)
- {
- node->appendEntry(location, nullptr, pattern, nullptr, ObjectPatternNode::BindingType::RestElement);
- }
- void setContainsObjectRestElement(ObjectPattern node, bool containsRestElement)
- {
- node->setContainsRestElement(containsRestElement);
- }
-
BindingPattern createBindingLocation(const JSTokenLocation&, const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, AssignmentContext context)
{
return new (m_parserArena) BindingNode(boundProperty, start, end, context);
Modified: trunk/Source/_javascript_Core/parser/NodeConstructors.h (216890 => 216891)
--- trunk/Source/_javascript_Core/parser/NodeConstructors.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/parser/NodeConstructors.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -234,19 +234,9 @@
, m_isClassProperty(isClassProperty)
{
}
-
- inline PropertyNode::PropertyNode(ExpressionNode* assign, Type type, PutType putType, SuperBinding superBinding, bool isClassProperty)
- : m_name(nullptr)
- , m_assign(assign)
- , m_type(type)
- , m_needsSuperBinding(superBinding == SuperBinding::Needed)
- , m_putType(putType)
- , m_isClassProperty(isClassProperty)
- {
- }
inline PropertyNode::PropertyNode(ExpressionNode* name, ExpressionNode* assign, Type type, PutType putType, SuperBinding superBinding, bool isClassProperty)
- : m_name(nullptr)
+ : m_name(0)
, m_expression(name)
, m_assign(assign)
, m_type(type)
@@ -304,12 +294,6 @@
, m_expression(_expression_)
{
}
-
- inline ObjectSpreadExpressionNode::ObjectSpreadExpressionNode(const JSTokenLocation& location, ExpressionNode* _expression_)
- : ExpressionNode(location)
- , m_expression(_expression_)
- {
- }
inline ArgumentListNode::ArgumentListNode(const JSTokenLocation& location, ExpressionNode* expr)
: ExpressionNode(location)
Modified: trunk/Source/_javascript_Core/parser/Nodes.h (216890 => 216891)
--- trunk/Source/_javascript_Core/parser/Nodes.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/parser/Nodes.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -646,11 +646,10 @@
class PropertyNode : public ParserArenaFreeable {
public:
- enum Type { Constant = 1, Getter = 2, Setter = 4, Computed = 8, Shorthand = 16, Spread = 32 };
+ enum Type { Constant = 1, Getter = 2, Setter = 4, Computed = 8, Shorthand = 16 };
enum PutType { Unknown, KnownDirect };
PropertyNode(const Identifier&, ExpressionNode*, Type, PutType, SuperBinding, bool isClassProperty);
- PropertyNode(ExpressionNode*, Type, PutType, SuperBinding, bool isClassProperty);
PropertyNode(ExpressionNode* propertyName, ExpressionNode*, Type, PutType, SuperBinding, bool isClassProperty);
ExpressionNode* expressionName() const { return m_expression; }
@@ -666,7 +665,7 @@
const Identifier* m_name;
ExpressionNode* m_expression;
ExpressionNode* m_assign;
- unsigned m_type : 6;
+ unsigned m_type : 5;
unsigned m_needsSuperBinding : 1;
unsigned m_putType : 1;
unsigned m_isClassProperty: 1;
@@ -748,18 +747,6 @@
bool isSpreadExpression() const override { return true; }
ExpressionNode* m_expression;
};
-
- class ObjectSpreadExpressionNode : public ExpressionNode, public ThrowableExpressionData {
- public:
- ObjectSpreadExpressionNode(const JSTokenLocation&, ExpressionNode*);
-
- ExpressionNode* _expression_() const { return m_expression; }
-
- private:
- RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
-
- ExpressionNode* m_expression;
- };
class ArgumentListNode : public ExpressionNode {
public:
@@ -2127,29 +2114,20 @@
Vector<Entry> m_targetPatterns;
};
- class ObjectPatternNode : public DestructuringPatternNode, public ThrowableExpressionData, public ParserArenaDeletable {
+ class ObjectPatternNode : public DestructuringPatternNode, public ParserArenaDeletable {
public:
using ParserArenaDeletable::operator new;
ObjectPatternNode();
- enum class BindingType {
- Element,
- RestElement
- };
- void appendEntry(const JSTokenLocation&, const Identifier& identifier, bool wasString, DestructuringPatternNode* pattern, ExpressionNode* defaultValue, BindingType bindingType)
+ void appendEntry(const JSTokenLocation&, const Identifier& identifier, bool wasString, DestructuringPatternNode* pattern, ExpressionNode* defaultValue)
{
- m_targetPatterns.append(Entry{ identifier, nullptr, wasString, pattern, defaultValue, bindingType });
+ m_targetPatterns.append(Entry { identifier, nullptr, wasString, pattern, defaultValue });
}
- void appendEntry(const JSTokenLocation&, ExpressionNode* propertyExpression, DestructuringPatternNode* pattern, ExpressionNode* defaultValue, BindingType bindingType)
+ void appendEntry(const JSTokenLocation&, ExpressionNode* propertyExpression, DestructuringPatternNode* pattern, ExpressionNode* defaultValue)
{
- m_targetPatterns.append(Entry{ Identifier(), propertyExpression, false, pattern, defaultValue, bindingType });
+ m_targetPatterns.append(Entry { Identifier(), propertyExpression, false, pattern, defaultValue });
}
-
- void setContainsRestElement(bool containsRestElement)
- {
- m_containsRestElement = containsRestElement;
- }
private:
void collectBoundIdentifiers(Vector<Identifier>&) const override;
@@ -2161,9 +2139,7 @@
bool wasString;
DestructuringPatternNode* pattern;
ExpressionNode* defaultValue;
- BindingType bindingType;
};
- bool m_containsRestElement { false };
Vector<Entry> m_targetPatterns;
};
Modified: trunk/Source/_javascript_Core/parser/Parser.cpp (216890 => 216891)
--- trunk/Source/_javascript_Core/parser/Parser.cpp 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/parser/Parser.cpp 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1013,8 +1013,6 @@
if (hasDestructuringPattern)
*hasDestructuringPattern = true;
- bool restElementWasFound = false;
-
do {
bool wasString = false;
@@ -1021,19 +1019,6 @@
if (match(CLOSEBRACE))
break;
- if (UNLIKELY(match(DOTDOTDOT))) {
- JSTokenLocation location = m_token.m_location;
- next();
- auto innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
- if (kind == DestructuringKind::DestructureToExpressions && !innerPattern)
- return 0;
- propagateError();
- context.appendObjectPatternRestEntry(objectPattern, location, innerPattern);
- restElementWasFound = true;
- context.setContainsObjectRestElement(objectPattern, restElementWasFound);
- break;
- }
-
const Identifier* propertyName = nullptr;
TreeExpression propertyExpression = 0;
TreeDestructuringPattern innerPattern = 0;
@@ -1108,7 +1093,7 @@
if (kind == DestructuringKind::DestructureToExpressions && !match(CLOSEBRACE))
return 0;
- consumeOrFail(CLOSEBRACE, restElementWasFound ? "Expected a closing '}' following a rest element destructuring pattern" : "Expected either a closing '}' or an ',' after a property destructuring pattern");
+ consumeOrFail(CLOSEBRACE, "Expected either a closing '}' or an ',' after a property destructuring pattern");
pattern = objectPattern;
break;
}
@@ -3804,16 +3789,6 @@
context.setEndOffset(node, m_lexer->currentOffset());
return context.createProperty(propertyName, node, static_cast<PropertyNode::Type>(PropertyNode::Constant | PropertyNode::Computed), PropertyNode::Unknown, complete, SuperBinding::NotNeeded, isClassProperty);
}
- case DOTDOTDOT: {
- auto spreadLocation = m_token.m_location;
- auto start = m_token.m_startPosition;
- auto divot = m_token.m_endPosition;
- next();
- TreeExpression elem = parseAssignmentExpressionOrPropagateErrorClass(context);
- failIfFalse(elem, "Cannot parse subject of a spread operation");
- auto node = context.createObjectSpreadExpression(spreadLocation, elem, start, divot, m_lastTokenEndPosition);
- return context.createProperty(node, PropertyNode::Spread, PropertyNode::Unknown, complete, SuperBinding::NotNeeded, isClassProperty);
- }
default:
failIfFalse(m_token.m_type & KeywordTokenFlag, "Expected a property name");
wasIdent = true; // Treat keyword token as an identifier
Modified: trunk/Source/_javascript_Core/parser/SyntaxChecker.h (216890 => 216891)
--- trunk/Source/_javascript_Core/parser/SyntaxChecker.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/parser/SyntaxChecker.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -76,7 +76,7 @@
ConditionalExpr, AssignmentExpr, TypeofExpr, NewTargetExpr,
DeleteExpr, ArrayLiteralExpr, BindingDestructuring, RestParameter,
ArrayDestructuring, ObjectDestructuring, SourceElementsResult,
- FunctionBodyResult, SpreadExpr, ObjectSpreadExpr, ArgumentsResult,
+ FunctionBodyResult, SpreadExpr, ArgumentsResult,
PropertyListResult, ArgumentsListResult, ElementsListResult,
StatementResult, FormalParameterListResult, ClauseResult,
ClauseListResult, CommaExpr, DestructuringAssignment,
@@ -194,7 +194,6 @@
int createArguments() { return ArgumentsResult; }
int createArguments(int) { return ArgumentsResult; }
ExpressionType createSpreadExpression(const JSTokenLocation&, ExpressionType, int, int, int) { return SpreadExpr; }
- ExpressionType createObjectSpreadExpression(const JSTokenLocation&, ExpressionType, int, int, int) { return ObjectSpreadExpr; }
TemplateString createTemplateString(const JSTokenLocation&, const Identifier*, const Identifier*) { return TemplateStringResult; }
TemplateStringList createTemplateStringList(TemplateString) { return TemplateStringListResult; }
TemplateStringList createTemplateStringList(TemplateStringList, TemplateString) { return TemplateStringListResult; }
@@ -213,10 +212,6 @@
ASSERT(name);
return Property(name, type);
}
- Property createProperty(int, PropertyNode::Type type, PropertyNode::PutType, bool, SuperBinding, bool)
- {
- return Property(type);
- }
Property createProperty(VM* vm, ParserArena& parserArena, double name, int, PropertyNode::Type type, PropertyNode::PutType, bool complete, SuperBinding, bool)
{
if (!complete)
@@ -357,12 +352,6 @@
void appendObjectPatternEntry(ArrayPattern, const JSTokenLocation&, _expression_, DestructuringPattern, _expression_)
{
}
- void appendObjectPatternRestEntry(ObjectPattern, const JSTokenLocation&, DestructuringPattern)
- {
- }
- void setContainsObjectRestElement(ObjectPattern, bool)
- {
- }
DestructuringPattern createBindingLocation(const JSTokenLocation&, const Identifier&, const JSTextPosition&, const JSTextPosition&, AssignmentContext)
{
Modified: trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp (216890 => 216891)
--- trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp 2017-05-16 00:21:59 UTC (rev 216891)
@@ -104,7 +104,6 @@
JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().definePropertyPrivateName(), objectConstructorDefineProperty, DontEnum, 3);
JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrototypeOfPrivateName(), objectConstructorGetPrototypeOf, DontEnum, 1);
JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getOwnPropertyNamesPrivateName(), objectConstructorGetOwnPropertyNames, DontEnum, 1);
- JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getOwnPropertyDescriptorPrivateName(), objectConstructorGetOwnPropertyDescriptor, DontEnum, 1);
}
// ES 19.1.1.1 Object([value])
Modified: trunk/Source/_javascript_Core/runtime/SetPrototype.cpp (216890 => 216891)
--- trunk/Source/_javascript_Core/runtime/SetPrototype.cpp 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/_javascript_Core/runtime/SetPrototype.cpp 2017-05-16 00:21:59 UTC (rev 216891)
@@ -67,7 +67,6 @@
JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, setProtoFuncClear, DontEnum, 0);
JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, setProtoFuncDelete, DontEnum, 1);
JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, DontEnum, 1, JSSetHasIntrinsic);
- JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().hasPrivateName(), setProtoFuncHas, DontEnum, 1, JSSetHasIntrinsic);
JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), setProtoFuncEntries, DontEnum, 0);
JSFunction* values = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().valuesPublicName().string(), setProtoFuncValues);
Modified: trunk/Source/WTF/ChangeLog (216890 => 216891)
--- trunk/Source/WTF/ChangeLog 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/WTF/ChangeLog 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,3 +1,13 @@
+2017-05-15 Mark Lam <mark....@apple.com>
+
+ Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
+ https://bugs.webkit.org/show_bug.cgi?id=172147
+
+ Rubber-stamped by Saam Barati.
+
+ * wtf/HashSet.h:
+ (WTF::=):
+
2017-05-14 Chris Dumez <cdu...@apple.com>
Drop PassRefPtr class from WTF
Modified: trunk/Source/WTF/wtf/HashSet.h (216890 => 216891)
--- trunk/Source/WTF/wtf/HashSet.h 2017-05-16 00:07:45 UTC (rev 216890)
+++ trunk/Source/WTF/wtf/HashSet.h 2017-05-16 00:21:59 UTC (rev 216891)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2005, 2006, 2007, 2008, 2011, 2013, 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2011, 2013 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
@@ -123,9 +123,6 @@
template<typename OtherCollection>
bool operator==(const OtherCollection&) const;
-
- template<typename OtherCollection>
- bool operator!=(const OtherCollection&) const;
private:
HashTableType m_impl;
@@ -380,13 +377,6 @@
}
return true;
}
-
- template<typename T, typename U, typename V>
- template<typename OtherCollection>
- inline bool HashSet<T, U, V>::operator!=(const OtherCollection& otherCollection) const
- {
- return !(*this == otherCollection);
- }
} // namespace WTF
