Title: [91284] trunk
Revision
91284
Author
[email protected]
Date
2011-07-19 12:16:28 -0700 (Tue, 19 Jul 2011)

Log Message

https://bugs.webkit.org/show_bug.cgi?id=64677
Fix bugs in String.prototype this handling.

Reviewed by Oliver Hunt.

Source/_javascript_Core: 

undefined/null this values should throw TypeErrors, not convert to
the global object, and primitive values should not be converted via
object types.

* runtime/StringPrototype.cpp:
(JSC::stringProtoFuncReplace):
(JSC::stringProtoFuncCharAt):
(JSC::stringProtoFuncCharCodeAt):
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncLastIndexOf):
(JSC::stringProtoFuncMatch):
(JSC::stringProtoFuncSearch):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSplit):
(JSC::stringProtoFuncSubstr):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
(JSC::stringProtoFuncToUpperCase):
(JSC::stringProtoFuncLocaleCompare):
(JSC::stringProtoFuncBig):
(JSC::stringProtoFuncSmall):
(JSC::stringProtoFuncBlink):
(JSC::stringProtoFuncBold):
(JSC::stringProtoFuncFixed):
(JSC::stringProtoFuncItalics):
(JSC::stringProtoFuncStrike):
(JSC::stringProtoFuncSub):
(JSC::stringProtoFuncSup):
(JSC::stringProtoFuncFontcolor):
(JSC::stringProtoFuncFontsize):
(JSC::stringProtoFuncAnchor):
(JSC::stringProtoFuncLink):
(JSC::trimString):
    - These methods should throw if this value is undefined,
      convert ToString directly, not via ToObject.

LayoutTests: 

* fast/js/script-tests/string-prototype-properties.js: Added.
* fast/js/string-prototype-properties-expected.txt: Added.
* fast/js/string-prototype-properties.html: Added.
    - Added layout test for string prototype functions with undefined/number as this value.

Modified Paths

Added Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (91283 => 91284)


--- trunk/LayoutTests/ChangeLog	2011-07-19 19:13:50 UTC (rev 91283)
+++ trunk/LayoutTests/ChangeLog	2011-07-19 19:16:28 UTC (rev 91284)
@@ -1,3 +1,15 @@
+2011-07-19  Gavin Barraclough  <[email protected]>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64677
+        Fix bugs in String.prototype this handling.
+
+        Reviewed by Oliver Hunt.
+
+        * fast/js/script-tests/string-prototype-properties.js: Added.
+        * fast/js/string-prototype-properties-expected.txt: Added.
+        * fast/js/string-prototype-properties.html: Added.
+            - Added layout test for string prototype functions with undefined/number as this value.
+
 2011-07-19  Robert Hogan  <[email protected]>
 
         REGRESSION: Incorrect layout at recline-online.com

Added: trunk/LayoutTests/fast/js/script-tests/string-prototype-properties.js (0 => 91284)


--- trunk/LayoutTests/fast/js/script-tests/string-prototype-properties.js	                        (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/string-prototype-properties.js	2011-07-19 19:16:28 UTC (rev 91284)
@@ -0,0 +1,56 @@
+description(
+'This is a test case for <a https://bugs.webkit.org/show_bug.cgi?id=64677">bug 64677</a>.'
+);
+
+// These calls pass undefined as this value, and as such should show in toObject.
+shouldThrow("String.prototype.toString.call(undefined)");
+shouldThrow("String.prototype.valueOf.call(undefined)");
+shouldThrow("String.prototype.charAt.call(undefined, 0)");
+shouldThrow("String.prototype.charCodeAt.call(undefined, 0)");
+shouldThrow("String.prototype.concat.call(undefined, 'five')");
+shouldThrow("String.prototype.indexOf.call(undefined, '2')");
+shouldThrow("String.prototype.lastIndexOf.call(undefined, '2')");
+shouldThrow("String.prototype.match.call(undefined, /2+/)");
+shouldThrow("String.prototype.replace.call(undefined, /2+/, '-')");
+shouldThrow("String.prototype.search.call(undefined, '4')");
+shouldThrow("String.prototype.slice.call(undefined, 1, 3)");
+shouldThrow("String.prototype.split.call(undefined, '2')");
+shouldThrow("String.prototype.slice.call(undefined, 1, 3)");
+shouldThrow("String.prototype.substr.call(undefined, 1, 3)");
+shouldThrow("String.prototype.substring.call(undefined, 1, 3)");
+shouldThrow("String.prototype.toLowerCase.call(undefined)");
+shouldThrow("String.prototype.toUpperCase.call(undefined)");
+shouldThrow("String.prototype.localeCompare.call(undefined, '1224')");
+shouldThrow("String.prototype.toLocaleLowerCase.call(undefined)");
+shouldThrow("String.prototype.toLocaleUpperCase.call(undefined)");
+shouldThrow("String.prototype.trim.call(undefined)");
+
+// These calls pass a primitive number as this value, toString and valueOf
+// should throw, all other method should convert ToString, without converting
+// via the Number object type.
+shouldThrow("String.prototype.toString.call(1224)");
+shouldThrow("String.prototype.valueOf.call(1224)");
+var numberPrototypeToString = Number.prototype.toString;
+Number.prototype.toString = (function(){ throw "SHOULD NOT BE REACHED"; });
+shouldBe("String.prototype.charAt.call(1224, 0)", '"1"');
+shouldBe("String.prototype.charCodeAt.call(1224, 0)", '0x31');
+shouldBe("String.prototype.concat.call(1224, 'five')", '"1224five"');
+shouldBe("String.prototype.indexOf.call(1224, '2')", '1');
+shouldBe("String.prototype.lastIndexOf.call(1224, '2')", '2');
+shouldBe("String.prototype.match.call(1224, /2+/)", '["22"]');
+shouldBe("String.prototype.replace.call(1224, /2+/, '-')", '"1-4"');
+shouldBe("String.prototype.search.call(1224, '4')", '3');
+shouldBe("String.prototype.slice.call(1224, 1, 3)", '"22"');
+shouldBe("String.prototype.split.call(1224, '2')", '["1","","4"]');
+shouldBe("String.prototype.slice.call(1224, 1, 3)", '"22"');
+shouldBe("String.prototype.substr.call(1224, 1, 3)", '"224"');
+shouldBe("String.prototype.substring.call(1224, 1, 3)", '"22"');
+shouldBe("String.prototype.toLowerCase.call(1224)", '"1224"');
+shouldBe("String.prototype.toUpperCase.call(1224)", '"1224"');
+shouldBe("String.prototype.localeCompare.call(1224, '1224')", '0');
+shouldBe("String.prototype.toLocaleLowerCase.call(1224)", '"1224"');
+shouldBe("String.prototype.toLocaleUpperCase.call(1224)", '"1224"');
+shouldBe("String.prototype.trim.call(1224)", '"1224"');
+Number.prototype.toString = numberPrototypeToString;
+
+var successfullyParsed = true;

Added: trunk/LayoutTests/fast/js/string-prototype-properties-expected.txt (0 => 91284)


--- trunk/LayoutTests/fast/js/string-prototype-properties-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/fast/js/string-prototype-properties-expected.txt	2011-07-19 19:16:28 UTC (rev 91284)
@@ -0,0 +1,51 @@
+This is a test case for bug 64677.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS String.prototype.toString.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.valueOf.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.charAt.call(undefined, 0) threw exception TypeError: Type error.
+PASS String.prototype.charCodeAt.call(undefined, 0) threw exception TypeError: Type error.
+PASS String.prototype.concat.call(undefined, 'five') threw exception TypeError: Type error.
+PASS String.prototype.indexOf.call(undefined, '2') threw exception TypeError: Type error.
+PASS String.prototype.lastIndexOf.call(undefined, '2') threw exception TypeError: Type error.
+PASS String.prototype.match.call(undefined, /2+/) threw exception TypeError: Type error.
+PASS String.prototype.replace.call(undefined, /2+/, '-') threw exception TypeError: Type error.
+PASS String.prototype.search.call(undefined, '4') threw exception TypeError: Type error.
+PASS String.prototype.slice.call(undefined, 1, 3) threw exception TypeError: Type error.
+PASS String.prototype.split.call(undefined, '2') threw exception TypeError: Type error.
+PASS String.prototype.slice.call(undefined, 1, 3) threw exception TypeError: Type error.
+PASS String.prototype.substr.call(undefined, 1, 3) threw exception TypeError: Type error.
+PASS String.prototype.substring.call(undefined, 1, 3) threw exception TypeError: Type error.
+PASS String.prototype.toLowerCase.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.toUpperCase.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.localeCompare.call(undefined, '1224') threw exception TypeError: Type error.
+PASS String.prototype.toLocaleLowerCase.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.toLocaleUpperCase.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.trim.call(undefined) threw exception TypeError: Type error.
+PASS String.prototype.toString.call(1224) threw exception TypeError: Type error.
+PASS String.prototype.valueOf.call(1224) threw exception TypeError: Type error.
+PASS String.prototype.charAt.call(1224, 0) is "1"
+PASS String.prototype.charCodeAt.call(1224, 0) is 0x31
+PASS String.prototype.concat.call(1224, 'five') is "1224five"
+PASS String.prototype.indexOf.call(1224, '2') is 1
+PASS String.prototype.lastIndexOf.call(1224, '2') is 2
+PASS String.prototype.match.call(1224, /2+/) is ["22"]
+PASS String.prototype.replace.call(1224, /2+/, '-') is "1-4"
+PASS String.prototype.search.call(1224, '4') is 3
+PASS String.prototype.slice.call(1224, 1, 3) is "22"
+PASS String.prototype.split.call(1224, '2') is ["1","","4"]
+PASS String.prototype.slice.call(1224, 1, 3) is "22"
+PASS String.prototype.substr.call(1224, 1, 3) is "224"
+PASS String.prototype.substring.call(1224, 1, 3) is "22"
+PASS String.prototype.toLowerCase.call(1224) is "1224"
+PASS String.prototype.toUpperCase.call(1224) is "1224"
+PASS String.prototype.localeCompare.call(1224, '1224') is 0
+PASS String.prototype.toLocaleLowerCase.call(1224) is "1224"
+PASS String.prototype.toLocaleUpperCase.call(1224) is "1224"
+PASS String.prototype.trim.call(1224) is "1224"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: trunk/LayoutTests/fast/js/string-prototype-properties.html (0 => 91284)


--- trunk/LayoutTests/fast/js/string-prototype-properties.html	                        (rev 0)
+++ trunk/LayoutTests/fast/js/string-prototype-properties.html	2011-07-19 19:16:28 UTC (rev 91284)
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href=""
+<script src=""
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src=""
+<script src=""
+</body>
+</html>

Modified: trunk/Source/_javascript_Core/ChangeLog (91283 => 91284)


--- trunk/Source/_javascript_Core/ChangeLog	2011-07-19 19:13:50 UTC (rev 91283)
+++ trunk/Source/_javascript_Core/ChangeLog	2011-07-19 19:16:28 UTC (rev 91284)
@@ -1,3 +1,46 @@
+2011-07-19  Gavin Barraclough  <[email protected]>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64677
+        Fix bugs in String.prototype this handling.
+
+        Reviewed by Oliver Hunt.
+
+        undefined/null this values should throw TypeErrors, not convert to
+        the global object, and primitive values should not be converted via
+        object types.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+            - These methods should throw if this value is undefined,
+              convert ToString directly, not via ToObject.
+
 2011-07-19  Filip Pizlo  <[email protected]>
 
         DFG JIT sometimes emits spill code even when the respective values

Modified: trunk/Source/_javascript_Core/runtime/StringPrototype.cpp (91283 => 91284)


--- trunk/Source/_javascript_Core/runtime/StringPrototype.cpp	2011-07-19 19:13:50 UTC (rev 91283)
+++ trunk/Source/_javascript_Core/runtime/StringPrototype.cpp	2011-07-19 19:16:28 UTC (rev 91284)
@@ -297,7 +297,9 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    JSString* sourceVal = thisValue.toThisJSString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    JSString* sourceVal = thisValue.isString() ? asString(thisValue) : jsString(exec, thisValue.toString(exec));
     JSValue pattern = exec->argument(0);
     JSValue replacement = exec->argument(1);
     JSGlobalData* globalData = &exec->globalData();
@@ -487,7 +489,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     unsigned len = s.length();
     JSValue a0 = exec->argument(0);
     if (a0.isUInt32()) {
@@ -507,7 +509,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     unsigned len = s.length();
     JSValue a0 = exec->argument(0);
     if (a0.isUInt32()) {
@@ -541,7 +543,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     int len = s.length();
 
     JSValue a0 = exec->argument(0);
@@ -572,7 +574,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     int len = s.length();
 
     JSValue a0 = exec->argument(0);
@@ -601,7 +603,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     JSGlobalData* globalData = &exec->globalData();
 
     JSValue a0 = exec->argument(0);
@@ -650,7 +652,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     JSGlobalData* globalData = &exec->globalData();
 
     JSValue a0 = exec->argument(0);
@@ -678,7 +680,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     int len = s.length();
 
     JSValue a0 = exec->argument(0);
@@ -705,7 +707,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toThisString(exec);
+    UString s = thisValue.toString(exec);
     JSGlobalData* globalData = &exec->globalData();
 
     JSValue a0 = exec->argument(0);
@@ -769,16 +771,19 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
-        return throwVMTypeError(exec);
     unsigned len;
     JSString* jsString = 0;
     UString uString;
     if (thisValue.isString()) {
         jsString = static_cast<JSString*>(thisValue.asCell());
         len = jsString->length();
+    } else if (thisValue.isUndefinedOrNull()) {
+        // CheckObjectCoercible
+        return throwVMTypeError(exec);
     } else {
-        uString = thisValue.toThisObject(exec)->toString(exec);
+        uString = thisValue.toString(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         len = uString.length();
     }
 
@@ -806,16 +811,19 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
-        return throwVMTypeError(exec);
     int len;
     JSString* jsString = 0;
     UString uString;
     if (thisValue.isString()) {
         jsString = static_cast<JSString*>(thisValue.asCell());
         len = jsString->length();
+    } else if (thisValue.isUndefinedOrNull()) {
+        // CheckObjectCoercible
+        return throwVMTypeError(exec);
     } else {
-        uString = thisValue.toThisObject(exec)->toString(exec);
+        uString = thisValue.toString(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         len = uString.length();
     }
 
@@ -854,7 +862,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    JSString* sVal = thisValue.toThisJSString(exec);
+    JSString* sVal = thisValue.isString() ? asString(thisValue) : jsString(exec, thisValue.toString(exec));
     const UString& s = sVal->value(exec);
 
     int sSize = s.length();
@@ -894,7 +902,7 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    JSString* sVal = thisValue.toThisJSString(exec);
+    JSString* sVal = thisValue.isString() ? asString(thisValue) : jsString(exec, thisValue.toString(exec));
     const UString& s = sVal->value(exec);
 
     int sSize = s.length();
@@ -937,8 +945,8 @@
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
 
-    UString s = thisValue.toThisString(exec);
     JSValue a0 = exec->argument(0);
     return JSValue::encode(jsNumber(localeCompare(s, a0.toString(exec))));
 }
@@ -946,70 +954,90 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<big>", s, "</big>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<small>", s, "</small>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<blink>", s, "</blink>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<b>", s, "</b>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<tt>", s, "</tt>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<i>", s, "</i>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<strike>", s, "</strike>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<sub>", s, "</sub>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<sup>", s, "</sup>"));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     JSValue a0 = exec->argument(0);
     return JSValue::encode(jsMakeNontrivialString(exec, "<font color=\"", a0.toString(exec), "\">", s, "</font>"));
 }
@@ -1017,7 +1045,9 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     JSValue a0 = exec->argument(0);
 
     uint32_t smallInteger;
@@ -1060,7 +1090,9 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     JSValue a0 = exec->argument(0);
     return JSValue::encode(jsMakeNontrivialString(exec, "<a name=\"", a0.toString(exec), "\">", s, "</a>"));
 }
@@ -1068,7 +1100,9 @@
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    UString s = thisValue.toThisString(exec);
+    if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
+        return throwVMTypeError(exec);
+    UString s = thisValue.toString(exec);
     JSValue a0 = exec->argument(0);
     UString linkText = a0.toString(exec);
 
@@ -1113,7 +1147,7 @@
 {
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwTypeError(exec);
-    UString str = thisValue.toThisString(exec);
+    UString str = thisValue.toString(exec);
     unsigned left = 0;
     if (trimKind & TrimLeft) {
         while (left < str.length() && isTrimWhitespace(str[left]))
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to