Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6fba1aeeb7239da58cbc5777e346052d9374b8f2
https://github.com/WebKit/WebKit/commit/6fba1aeeb7239da58cbc5777e346052d9374b8f2
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
A JSTests/stress/get-prototype-from-constructor-revoked-proxy.js
M JSTests/test262/expectations-linux.yaml
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/runtime/FunctionConstructor.cpp
M Source/JavaScriptCore/runtime/InternalFunction.cpp
M Source/JavaScriptCore/runtime/InternalFunction.h
M Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
Log Message:
-----------
[JSC] `GetPrototypeFromConstructor` should read `prototype` before calling
`GetFunctionRealm`
https://bugs.webkit.org/show_bug.cgi?id=327141
Reviewed by Yusuke Suzuki.
GetPrototypeFromConstructor [1] reads newTarget.prototype first and calls
GetFunctionRealm only when the result is not an object. Built-in
constructors called GetFunctionRealm first to pick the base structure,
so a revoked Proxy threw a TypeError too early, or not at all:
let { proxy, revoke } = Proxy.revocable(function () { }, {});
let bound = proxy.bind();
bound.prototype = {};
revoke();
Reflect.construct(Array, [3], bound); // threw a TypeError
Add tryGetFunctionRealm, which returns nullptr for a revoked Proxy
without throwing. Callers use it to pick the base structure and fall
back to the current realm. createSubclassStructure calls
getFunctionRealm after it finds that prototype is not an object.
[1]: https://tc39.es/ecma262/#sec-getprototypefromconstructor
Test: JSTests/stress/get-prototype-from-constructor-revoked-proxy.js
* JSTests/stress/get-prototype-from-constructor-revoked-proxy.js: Added.
(shouldBe):
(shouldThrow):
(boundFunctionWithRevokedTarget):
(proxyRevokedByPrototypeGetter.get return):
(proxyRevokedByPrototypeGetter):
(const.GeneratorFunction):
(const.AsyncFunction):
(async const.AsyncGeneratorFunction):
(async const):
(other):
* JSTests/test262/expectations-linux.yaml:
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/FunctionConstructor.cpp:
(JSC::constructFunctionSkippingEvalEnabledCheck):
* Source/JavaScriptCore/runtime/InternalFunction.cpp:
(JSC::InternalFunction::createSubclassStructure):
(JSC::tryGetFunctionRealm):
(JSC::getFunctionRealm):
* Source/JavaScriptCore/runtime/InternalFunction.h:
* Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h:
(JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation const):
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::constructObjectWithNewTarget):
Canonical link: https://commits.webkit.org/323408@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
