Title: [198589] trunk/Source/_javascript_Core
- Revision
- 198589
- Author
- [email protected]
- Date
- 2016-03-23 12:42:32 -0700 (Wed, 23 Mar 2016)
Log Message
Array.prototype native functions' species constructors should work with proxies
https://bugs.webkit.org/show_bug.cgi?id=155798
Reviewed by Mark Lam.
Before native the species constructors were checking if the this value was a JSArray.
Instead they should look check that the this value returns true on Array.isArray.
* runtime/ArrayPrototype.cpp:
(JSC::speciesConstructArray):
* tests/es6.yaml:
* tests/stress/proxy-array-prototype-methods.js:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (198588 => 198589)
--- trunk/Source/_javascript_Core/ChangeLog 2016-03-23 19:21:11 UTC (rev 198588)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-03-23 19:42:32 UTC (rev 198589)
@@ -1,3 +1,18 @@
+2016-03-23 Keith Miller <[email protected]>
+
+ Array.prototype native functions' species constructors should work with proxies
+ https://bugs.webkit.org/show_bug.cgi?id=155798
+
+ Reviewed by Mark Lam.
+
+ Before native the species constructors were checking if the this value was a JSArray.
+ Instead they should look check that the this value returns true on Array.isArray.
+
+ * runtime/ArrayPrototype.cpp:
+ (JSC::speciesConstructArray):
+ * tests/es6.yaml:
+ * tests/stress/proxy-array-prototype-methods.js:
+
2016-03-23 Saam barati <[email protected]>
We should not disable inlining when the debugger is enabled
Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp (198588 => 198589)
--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2016-03-23 19:21:11 UTC (rev 198588)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2016-03-23 19:42:32 UTC (rev 198589)
@@ -184,7 +184,7 @@
{
// ECMA 9.4.2.3: https://tc39.github.io/ecma262/#sec-arrayspeciescreate
JSValue constructor = jsUndefined();
- if (LIKELY(isJSArray(thisObject))) {
+ if (LIKELY(isArray(exec, thisObject))) {
// Fast path in the normal case where the user has not set an own constructor and the Array.prototype.constructor is normal.
// We need prototype check for subclasses of Array, which are Array objects but have a different prototype by default.
if (LIKELY(!thisObject->hasCustomProperties()
@@ -207,7 +207,9 @@
if (constructor.isNull())
return std::make_pair(SpeciesConstructResult::FastPath, nullptr);;
}
- }
+ } else if (exec->hadException())
+ return std::make_pair(SpeciesConstructResult::Exception, nullptr);
+
if (constructor.isUndefined())
return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
Modified: trunk/Source/_javascript_Core/tests/es6.yaml (198588 => 198589)
--- trunk/Source/_javascript_Core/tests/es6.yaml 2016-03-23 19:21:11 UTC (rev 198588)
+++ trunk/Source/_javascript_Core/tests/es6.yaml 2016-03-23 19:42:32 UTC (rev 198589)
@@ -959,7 +959,7 @@
- path: es6/Proxy_internal_get_calls_Array.prototype.shift.js
cmd: runES6 :normal
- path: es6/Proxy_internal_get_calls_Array.prototype.splice.js
- cmd: runES6 :fail
+ cmd: runES6 :normal
- path: es6/Proxy_internal_get_calls_Array.prototype.toString.js
cmd: runES6 :normal
- path: es6/Proxy_internal_get_calls_Array.prototype_iteration_methods.js
Modified: trunk/Source/_javascript_Core/tests/stress/proxy-array-prototype-methods.js (198588 => 198589)
--- trunk/Source/_javascript_Core/tests/stress/proxy-array-prototype-methods.js 2016-03-23 19:21:11 UTC (rev 198588)
+++ trunk/Source/_javascript_Core/tests/stress/proxy-array-prototype-methods.js 2016-03-23 19:42:32 UTC (rev 198589)
@@ -140,14 +140,55 @@
assert(hasProps.has("3"));
assert(hasProps.has("4"));
- assert(getProps.size === 4);
+ assert(getProps.size === 5);
assert(getProps.has("splice"));
assert(getProps.has("length"));
+ assert(getProps.has("constructor"));
assert(getProps.has("2"));
assert(getProps.has("4"));
});
test(function() {
+ let delProps = new Set;
+ let hasProps = new Set;
+ let getProps = new Set;
+ let target = [ 0, , 1, , 2];
+ let handler = {
+ get(theTarget, key) {
+ getProps.add(key);
+ return Reflect.get(theTarget, key);
+ },
+ has(theTarget, key) {
+ hasProps.add(key);
+ return Reflect.has(theTarget, key);
+ },
+ deleteProperty(theTarget, key)
+ {
+ delProps.add(key);
+ return Reflect.deleteProperty(theTarget, key);
+ }
+ };
+
+ let proxy = new Proxy(target, handler);
+ proxy.slice(1, 5);
+
+ assert(delProps.size === 0);
+
+ assert(hasProps.size === 4);
+ assert(hasProps.has("1"));
+ assert(hasProps.has("2"));
+ assert(hasProps.has("3"));
+ assert(hasProps.has("4"));
+
+ assert(getProps.size === 5);
+ assert(getProps.has("slice"));
+ assert(getProps.has("length"));
+ assert(getProps.has("constructor"));
+ assert(getProps.has("2"));
+ assert(getProps.has("4"));
+});
+
+test(function() {
let x = [1,2,3];
x.__proto__ = new Proxy([], {
get(theTarget, prop, receiver) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
