Title: [203790] trunk/Source/_javascript_Core
- Revision
- 203790
- Author
- [email protected]
- Date
- 2016-07-27 13:55:23 -0700 (Wed, 27 Jul 2016)
Log Message
The second argument for Function.prototype.apply should be array-like or null/undefined.
https://bugs.webkit.org/show_bug.cgi?id=160212
<rdar://problem/27328525>
Reviewed by Filip Pizlo.
The spec for Function.prototype.apply says its second argument can only be null,
undefined, or must be array-like. See
https://tc39.github.io/ecma262/#sec-function.prototype.apply and
https://tc39.github.io/ecma262/#sec-createlistfromarraylike.
Our previous implementation was not handling this correctly for SymbolType.
This is now fixed.
* interpreter/Interpreter.cpp:
(JSC::sizeOfVarargs):
* tests/stress/apply-second-argument-must-be-array-like.js: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (203789 => 203790)
--- trunk/Source/_javascript_Core/ChangeLog 2016-07-27 20:52:50 UTC (rev 203789)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-07-27 20:55:23 UTC (rev 203790)
@@ -1,3 +1,23 @@
+2016-07-27 Mark Lam <[email protected]>
+
+ The second argument for Function.prototype.apply should be array-like or null/undefined.
+ https://bugs.webkit.org/show_bug.cgi?id=160212
+ <rdar://problem/27328525>
+
+ Reviewed by Filip Pizlo.
+
+ The spec for Function.prototype.apply says its second argument can only be null,
+ undefined, or must be array-like. See
+ https://tc39.github.io/ecma262/#sec-function.prototype.apply and
+ https://tc39.github.io/ecma262/#sec-createlistfromarraylike.
+
+ Our previous implementation was not handling this correctly for SymbolType.
+ This is now fixed.
+
+ * interpreter/Interpreter.cpp:
+ (JSC::sizeOfVarargs):
+ * tests/stress/apply-second-argument-must-be-array-like.js: Added.
+
2016-07-27 Saam Barati <[email protected]>
MathICs should be able to emit only a jump along the inline path when they don't have any type data
Modified: trunk/Source/_javascript_Core/interpreter/Interpreter.cpp (203789 => 203790)
--- trunk/Source/_javascript_Core/interpreter/Interpreter.cpp 2016-07-27 20:52:50 UTC (rev 203789)
+++ trunk/Source/_javascript_Core/interpreter/Interpreter.cpp 2016-07-27 20:55:23 UTC (rev 203790)
@@ -215,10 +215,12 @@
length = jsCast<ScopedArguments*>(cell)->length(callFrame);
break;
case StringType:
+ case SymbolType:
callFrame->vm().throwException(callFrame, createInvalidFunctionApplyParameterError(callFrame, arguments));
return 0;
+
default:
- ASSERT(arguments.isObject());
+ RELEASE_ASSERT(arguments.isObject());
length = getLength(callFrame, jsCast<JSObject*>(cell));
if (UNLIKELY(callFrame->hadException()))
return 0;
Added: trunk/Source/_javascript_Core/tests/stress/apply-second-argument-must-be-array-like.js (0 => 203790)
--- trunk/Source/_javascript_Core/tests/stress/apply-second-argument-must-be-array-like.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/apply-second-argument-must-be-array-like.js 2016-07-27 20:55:23 UTC (rev 203790)
@@ -0,0 +1,49 @@
+//@ runDefault
+
+function assert(x) {
+ if (!x)
+ throw Error("Bad");
+}
+
+function shouldThrow(expr) {
+ let testFunc = new Function(expr);
+ for (let i = 0; i < 10000; i++) {
+ let error;
+ try {
+ testFunc();
+ } catch (e) {
+ error = e;
+ }
+ assert(error);
+ }
+}
+
+function shouldNotThrow(expr) {
+ let testFunc = new Function(expr);
+ for (let i = 0; i < 10000; i++) {
+ let error;
+ try {
+ testFunc();
+ } catch (e) {
+ error = e;
+ }
+ assert(!error);
+ }
+}
+
+function foo() { }
+
+shouldThrow("foo.apply(undefined, true)");
+shouldThrow("foo.apply(undefined, false)");
+shouldThrow("foo.apply(undefined, 100)");
+shouldThrow("foo.apply(undefined, 123456789.12345)");
+shouldThrow("foo.apply(undefined, 1.0/1.0)");
+shouldThrow("foo.apply(undefined, 1.0/0)");
+shouldThrow("foo.apply(undefined, 'hello')");
+shouldThrow("foo.apply(undefined, Symbol())");
+
+shouldNotThrow("foo.apply(undefined, undefined)");
+shouldNotThrow("foo.apply(undefined, null)");
+shouldNotThrow("foo.apply(undefined, {})");
+shouldNotThrow("foo.apply(undefined, [])");
+shouldNotThrow("foo.apply(undefined, function(){})");
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
