Changeset 197144 in webkit for trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

Timestamp:

Feb 25, 2016, 4:15:58 PM (9 years ago)

Author:

[email protected]

Message:

[ES6] for...in iteration doesn't comply with the specification
​https://bugs.webkit.org/show_bug.cgi?id=154665

Reviewed by Michael Saboff.

If you read ForIn/OfHeadEvaluation inside the spec:
​https://tc39.github.io/ecma262/#sec-runtime-semantics-forin-div-ofheadevaluation-tdznames-expr-iterationkind
It calls EnumerateObjectProperties(obj) to get a set of properties
to enumerate over (it models this "set" as en ES6 generator function).
EnumerateObjectProperties is defined in section 13.7.5.15:
​https://tc39.github.io/ecma262/#sec-enumerate-object-properties
The implementation calls Reflect.getOwnPropertyDescriptor(.) on the
properties it sees. We must do the same by modeling the operation as
a GetOwnProperty instead of a HasProperty internal method call.

• jit/JITOperations.cpp:
• jit/JITOperations.h:
• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/JSObject.cpp:

(JSC::JSObject::hasProperty):
(JSC::JSObject::hasPropertyGeneric):

• runtime/JSObject.h:
• tests/stress/proxy-get-own-property.js:

(assert):
(let.handler.getOwnPropertyDescriptor):
(i.set assert):

File:

• trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -603 +603 @@
     pc[4].u.arrayProfile->observeStructure(base->structure(vm));
     ASSERT(property.isUInt32());
-    RETURN(jsBoolean(base->hasProperty(exec, property.asUInt32())));
+    RETURN(jsBoolean(base->hasPropertyGeneric(exec, property.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty)));
 }
 
@@ -615 +615 @@
     if (base->structure(vm)->id() == enumerator->cachedStructureID())
         RETURN(jsBoolean(true));
-    RETURN(jsBoolean(base->hasProperty(exec, asString(property.asCell())->toIdentifier(exec))));
+    RETURN(jsBoolean(base->hasPropertyGeneric(exec, asString(property.asCell())->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
 }
 
@@ -625 +625 @@
     bool result;
     if (property.isString())
-        result = base->hasProperty(exec, asString(property.asCell())->toIdentifier(exec));
+        result = base->hasPropertyGeneric(exec, asString(property.asCell())->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty);
     else {
         ASSERT(property.isUInt32());
-        result = base->hasProperty(exec, property.asUInt32());
+        result = base->hasPropertyGeneric(exec, property.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty);
     }
     RETURN(jsBoolean(result));