Diff
Modified: trunk/LayoutTests/ChangeLog (202795 => 202796)
--- trunk/LayoutTests/ChangeLog 2016-07-03 21:36:48 UTC (rev 202795)
+++ trunk/LayoutTests/ChangeLog 2016-07-04 03:25:04 UTC (rev 202796)
@@ -1,3 +1,18 @@
+2016-07-03 Benjamin Poulain <[email protected]>
+
+ [JSC] __lookupGetter__ and __lookupSetter__ should not ignore exceptions
+ https://bugs.webkit.org/show_bug.cgi?id=159390
+
+ Reviewed by Mark Lam.
+
+ * js/property-getters-and-setters-expected.txt:
+ * js/script-tests/property-getters-and-setters.js:
+ (getter17):
+ (get getter17):
+ (getOwnPropertyDescriptor):
+ (setter18):
+ (set setter18):
+
2016-07-03 Frederic Wang <[email protected]>
Update windows test expectations for some MathML tests.
Modified: trunk/LayoutTests/js/property-getters-and-setters-expected.txt (202795 => 202796)
--- trunk/LayoutTests/js/property-getters-and-setters-expected.txt 2016-07-03 21:36:48 UTC (rev 202795)
+++ trunk/LayoutTests/js/property-getters-and-setters-expected.txt 2016-07-04 03:25:04 UTC (rev 202796)
@@ -58,6 +58,31 @@
PASS o16.__defineSetter__('a', function(){}) did not throw exception.
PASS o16.__defineSetter__('b', function(){}) threw exception TypeError: Attempting to change configurable attribute of unconfigurable property..
PASS o16.__defineSetter__('b', function(){}) threw exception TypeError: Attempting to change configurable attribute of unconfigurable property..
+__lookupGetter__ can be interrupted by a proxy throwing an exception
+PASS o17.property is "WebKit!"
+PASS o17.__lookupGetter__('property') is getter17
+PASS o17.__lookupSetter__('property') is undefined
+PASS o17Proxy.__lookupGetter__('property') threw exception o17 Proxy raised exception.
+PASS o17Proxy.__lookupSetter__('property') threw exception o17 Proxy raised exception.
+PASS o17Proxy.property is "WebKit!"
+PASS o17.property is "WebKit!"
+PASS o17.__lookupGetter__('property') is getter17
+__lookupSetter__ can be interrupted by a proxy throwing an exception
+PASS o18.property = 5 is 5
+PASS o18.property is undefined
+PASS o18.value is 5
+PASS o18.__lookupGetter__('property') is undefined
+PASS o18.__lookupSetter__('property') is setter18
+PASS o18Proxy.__lookupGetter__('property') threw exception o18 Proxy raised exception.
+PASS o18Proxy.__lookupSetter__('property') threw exception o18 Proxy raised exception.
+PASS o18Proxy.property = '_javascript_Core!' threw exception o18 Proxy raised exception.
+PASS o18Proxy.property is undefined
+PASS o18Proxy.value is 5
+PASS o18.property = '_javascript_Core!' is "_javascript_Core!"
+PASS o18.property is undefined
+PASS o18.value is "_javascript_Core!"
+PASS o18.__lookupGetter__('property') is undefined
+PASS o18.__lookupSetter__('property') is setter18
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/js/script-tests/property-getters-and-setters.js (202795 => 202796)
--- trunk/LayoutTests/js/script-tests/property-getters-and-setters.js 2016-07-03 21:36:48 UTC (rev 202795)
+++ trunk/LayoutTests/js/script-tests/property-getters-and-setters.js 2016-07-04 03:25:04 UTC (rev 202796)
@@ -123,3 +123,40 @@
shouldNotThrow("o16.__defineSetter__('a', function(){})");
shouldThrow("o16.__defineSetter__('b', function(){})");
shouldThrow("o16.__defineSetter__('b', function(){})");
+
+debug("__lookupGetter__ can be interrupted by a proxy throwing an exception");
+var getter17 = () => { return "WebKit!"}
+var o17 = Object.defineProperty(new Object, 'property', { get: getter17 });
+shouldBeEqualToString("o17.property", "WebKit!");
+shouldBe("o17.__lookupGetter__('property')", "getter17");
+shouldBe("o17.__lookupSetter__('property')", "undefined");
+
+var o17Exception = { toString: () => { return "o17 Proxy raised exception"; } };
+var o17Proxy = new Proxy(o17, { getOwnPropertyDescriptor: () => { throw o17Exception; } });
+shouldThrow("o17Proxy.__lookupGetter__('property')", o17Exception);
+shouldThrow("o17Proxy.__lookupSetter__('property')", o17Exception);
+shouldBeEqualToString("o17Proxy.property", "WebKit!");
+shouldBeEqualToString("o17.property", "WebKit!");
+shouldBe("o17.__lookupGetter__('property')", "getter17");
+
+debug("__lookupSetter__ can be interrupted by a proxy throwing an exception");
+var setter18 = function (newValue) { return this.value = newValue; }
+var o18 = Object.defineProperty(new Object, 'property', { set: setter18 });
+shouldBe("o18.property = 5", "5");
+shouldBe("o18.property", "undefined");
+shouldBe("o18.value", "5");
+shouldBe("o18.__lookupGetter__('property')", "undefined");
+shouldBe("o18.__lookupSetter__('property')", "setter18");
+
+var o18Exception = { toString: () => { return "o18 Proxy raised exception"; } };
+var o18Proxy = new Proxy(o18, { getOwnPropertyDescriptor: () => { throw o18Exception; } });
+shouldThrow("o18Proxy.__lookupGetter__('property')", o18Exception);
+shouldThrow("o18Proxy.__lookupSetter__('property')", o18Exception);
+shouldThrow("o18Proxy.property = '_javascript_Core!'", o18Exception);
+shouldBe("o18Proxy.property", "undefined");
+shouldBe("o18Proxy.value", "5");
+shouldBeEqualToString("o18.property = '_javascript_Core!'", "_javascript_Core!");
+shouldBe("o18.property", "undefined");
+shouldBeEqualToString("o18.value", "_javascript_Core!");
+shouldBe("o18.__lookupGetter__('property')", "undefined");
+shouldBe("o18.__lookupSetter__('property')", "setter18");
Modified: trunk/Source/_javascript_Core/ChangeLog (202795 => 202796)
--- trunk/Source/_javascript_Core/ChangeLog 2016-07-03 21:36:48 UTC (rev 202795)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-07-04 03:25:04 UTC (rev 202796)
@@ -1,3 +1,20 @@
+2016-07-03 Benjamin Poulain <[email protected]>
+
+ [JSC] __lookupGetter__ and __lookupSetter__ should not ignore exceptions
+ https://bugs.webkit.org/show_bug.cgi?id=159390
+
+ Reviewed by Mark Lam.
+
+ See:
+ -https://tc39.github.io/ecma262/#sec-object.prototype.__lookupGetter__
+ -https://tc39.github.io/ecma262/#sec-object.prototype.__lookupSetter__
+
+ They are both supposed to be regular [[GetOwnProperty]].
+
+ * runtime/ObjectPrototype.cpp:
+ (JSC::objectProtoFuncLookupGetter):
+ (JSC::objectProtoFuncLookupSetter):
+
2016-07-03 Saam Barati <[email protected]>
BytecodeGenerator::getVariablesUnderTDZ is too conservative
Modified: trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp (202795 => 202796)
--- trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp 2016-07-03 21:36:48 UTC (rev 202795)
+++ trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp 2016-07-04 03:25:04 UTC (rev 202796)
@@ -187,7 +187,7 @@
if (exec->hadException())
return JSValue::encode(jsUndefined());
- PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+ PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
if (thisObject->getPropertySlot(exec, propertyName, slot)) {
if (slot.isAccessor()) {
GetterSetter* getterSetter = slot.getterSetter();
@@ -214,7 +214,7 @@
if (exec->hadException())
return JSValue::encode(jsUndefined());
- PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+ PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
if (thisObject->getPropertySlot(exec, propertyName, slot)) {
if (slot.isAccessor()) {
GetterSetter* getterSetter = slot.getterSetter();
