Reviewers: Michael Starzinger, rossberg,

Message:
This was originally contributed in another CL, where I already LGTMed it.

https://chromiumcodereview.appspot.com/10423008/

Description:
Fix RegExp.prototype.toString for incompatible receivers.

BUG=v8:1981
TEST=mjsunit/regexp


Please review this at https://chromiumcodereview.appspot.com/10426005/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
  M src/regexp.js
  M test/mjsunit/regexp.js


Index: src/regexp.js
diff --git a/src/regexp.js b/src/regexp.js
index a574f62bf6a040b808bc40ea380f8a497f2261fe..44f8dd1234d9055afecd6be061839725b65f7d7d 100644
--- a/src/regexp.js
+++ b/src/regexp.js
@@ -278,6 +278,10 @@ function TrimRegExp(regexp) {


 function RegExpToString() {
+  if (!IS_REGEXP(this)) {
+    throw MakeTypeError('incompatible_method_receiver',
+                        ['RegExp.prototype.toString', this]);
+  }
   var result = '/' + this.source + '/';
   if (this.global) result += 'g';
   if (this.ignoreCase) result += 'i';
Index: test/mjsunit/regexp.js
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index ec82c96e094efe1f32e9cf1789bc0ea6e82fc9f2..c2d92823bce985a3c66e1cba873da85e7cab4d94 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -705,3 +705,14 @@ assertThrows("RegExp('(?!*)')");
 // Test trimmed regular expression for RegExp.test().
 assertTrue(/.*abc/.test("abc"));
 assertFalse(/.*\d+/.test("q"));
+
+// Test that RegExp.prototype.toString() throws TypeError for
+// incompatible receivers (ES5 section 15.10.6 and 15.10.6.4).
+assertThrows("RegExp.prototype.toString.call(null)", TypeError);
+assertThrows("RegExp.prototype.toString.call(0)", TypeError);
+assertThrows("RegExp.prototype.toString.call('')", TypeError);
+assertThrows("RegExp.prototype.toString.call(false)", TypeError);
+assertThrows("RegExp.prototype.toString.call(true)", TypeError);
+assertThrows("RegExp.prototype.toString.call([])", TypeError);
+assertThrows("RegExp.prototype.toString.call({})", TypeError);
+assertThrows("RegExp.prototype.toString.call(function(){})", TypeError);


--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev

Reply via email to