Changeset 30871 in webkit for trunk/JavaScriptCore/tests


Ignore:
Timestamp:
Mar 7, 2008, 11:46:33 AM (17 years ago)
Author:
[email protected]
Message:

JavaScriptCore:

Reviewed by Darin Adler.


Fixed <rdar://problem/5689093> Stricter (ES4) eval semantics


The basic rule is:


  • "eval(s)" is treated as an operator that gives the ES3 eval behavior.

... but only if there is no overriding declaration of "eval" in scope.

  • All other invocations treat eval as a function that evaluates a script in the context of its "this" object.

... but if its "this" object is not the global object it was
originally associated with, eval throws an exception.


Because only expressions of the form "eval(s)" have access to local
scope, the compiler can now statically determine whether a function
needs local scope to be dynamic.

  • kjs/nodes.h: Added FunctionCallEvalNode. It works just like FuncationCallResolveNode, except it statically indicates that the node may execute eval in the ES3 way.
  • kjs/nodes.cpp:
  • kjs/nodes2string.cpp:
  • tests/mozilla/expected.html: This patch happens to fix a Mozilla JS test, but it's a bit of a pyrrhic victory. The test intends to test Mozilla's generic API for calling eval on any object, but, in reality, we only support calling eval on the global object.

LayoutTests:

Reviewed by Darin Adler.

Tests for <rdar://problem/5689093> Stricter (ES4) eval semantics


  • fast/js/eval-cross-window-expected.txt: Added.
  • fast/js/eval-cross-window.html: Added.
  • fast/js/eval-keyword-vs-function-expected.txt: Added.
  • fast/js/eval-keyword-vs-function.html: Added.
  • fast/js/eval-overriding-expected.txt: Added.
  • fast/js/eval-overriding.html: Added.


Tests to make sure not to regress security:

  • http/tests/security/resources/xss-eval2.html: Added.
  • http/tests/security/resources/xss-eval3.html: Added.
  • http/tests/security/xss-eval-expected.txt: Added.
  • http/tests/security/xss-eval.html: Added.

I removed these tests because we no longer match the behavior they
expected, and the new tests are more comprehensive:


  • fast/js/window-eval-context-expected.txt: Removed.
  • fast/js/window-eval-context.html: Removed.
  • fast/js/window-eval-tearoff-expected.txt: Removed.
  • fast/js/window-eval-tearoff.html: Removed.
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/tests/mozilla/expected.html

    r29118 r30871  
    88Test List: All tests<br>
    99Skip List: (none)<br>
    10 1135 test(s) selected, 1127 test(s) completed, 52 failures reported (4.61% failed)<br>
    11 Engine command line: /Users/darin/Build/Debug/testkjs <br>
    12 OS type: Darwin Darin-Adlers-Mac-Pro.local 9.1.0 Darwin Kernel Version 9.1.0: Wed Oct 31 17:46:22 PDT 2007; root:xnu-1228.0.2~1/RELEASE_I386 i386<br>
    13 Testcase execution time: 1 minutes, 13 seconds.<br>
    14 Tests completed on Thu Jan  3 00:46:35 2008.<br><br>
     101135 test(s) selected, 1127 test(s) completed, 51 failures reported (4.52% failed)<br>
     11Engine command line: /Volumes/Big/ggaren/build/Debug/testkjs <br>
     12OS type: Darwin il0301e-dhcp191.apple.com 9.2.0 Darwin Kernel Version 9.2.0: Tue Feb  5 16:13:22 PST 2008; root:xnu-1228.3.13~1/RELEASE_I386 i386<br>
     13Testcase execution time: 1 minutes, 50 seconds.<br>
     14Tests completed on Thu Mar  6 13:53:55 2008.<br><br>
    1515[ <a href='#fail_detail'>Failure Details</a> | <a href='#retest_list'>Retest List</a> | <a href='menu.html'>Test Selection Page</a> ]<br>
    1616<hr>
    … …  
    4444(Mon Feb 28 2000 15:59:59 GMT-0800 (PST)).toLocaleTimeString() = 3:59:59 PM PST FAILED! expected: 15:59:59<br>
    4545(Tue Feb 29 2000 00:00:00 GMT-0800 (PST)).toLocaleTimeString() = 12:00:00 AM PST FAILED! expected: 00:00:00<br>
    46 (Thu Jan 03 2008 00:46:22 GMT-0800 (PST)).toLocaleTimeString() = 12:46:22 AM PST FAILED! expected: 00:46:22<br>
    47 (Thu Jan 03 2008 08:46:22 GMT-0800 (PST)).toLocaleTimeString() = 8:46:22 AM PST FAILED! expected: 08:46:22<br>
     46(Thu Mar 06 2008 13:53:32 GMT-0800 (PST)).toLocaleTimeString() = 1:53:32 PM PST FAILED! expected: 13:53:32<br>
     47(Thu Mar 06 2008 21:53:32 GMT-0800 (PST)).toLocaleTimeString() = 9:53:32 PM PST FAILED! expected: 21:53:32<br>
    4848(Fri Dec 31 2004 16:00:00 GMT-0800 (PST)).toLocaleTimeString() = 4:00:00 PM PST FAILED! expected: 16:00:00<br>
    4949(Fri Dec 31 2004 15:59:59 GMT-0800 (PST)).toLocaleTimeString() = 3:59:59 PM PST FAILED! expected: 15:59:59<br>
    … …  
    167167Testcase terminated with signal 0<br>
    168168Complete testcase output was:<br>
    169 [82270] ./ecma_3/Statements/regress-194364.js line 1: SyntaxError: Parse error<br>
     169[93325] ./ecma_3/Statements/regress-194364.js line 1: SyntaxError: Parse error<br>
    170170</tt><br>
    171171<a name='failure9'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Unicode/uc-001.js'>ecma_3/Unicode/uc-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=23610' target='other_window'>Bug Number 23610</a><br>
    … …  
    318318Complete testcase output was:<br>
    319319script-001 NativeScript<br>
    320 [82375] ./js1_3/Script/script-001.js line 133: ReferenceError: Can't find variable: Script<br>
     320[93430] ./js1_3/Script/script-001.js line 133: ReferenceError: Can't find variable: Script<br>
    321321</tt><br>
    322322<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
    … …  
    352352Testcase terminated with signal 0<br>
    353353Complete testcase output was:<br>
    354 [82420] ./js1_5/Exceptions/errstack-001.js line 247: TypeError: Undefined value<br>
     354[93477] ./js1_5/Exceptions/errstack-001.js line 247: TypeError: Undefined value<br>
    355355</tt><br>
    356356<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
    … …  
    361361BUGNUMBER: 50447<br>
    362362STATUS: Test (non-ECMA) Error object properties fileName, lineNumber<br>
    363 [82421] ./js1_5/Exceptions/regress-50447.js line 65: TypeError: Undefined value<br>
     363[93478] ./js1_5/Exceptions/regress-50447.js line 65: TypeError: Undefined value<br>
    364364</tt><br>
    365365<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
    … …  
    386386Testcase terminated with signal 0<br>
    387387Complete testcase output was:<br>
    388 [82436] ./js1_5/Object/regress-90596-001.js line 48: TypeError: Value undefined (result of expression obj.toSource) is not object.<br>
     388[93493] ./js1_5/Object/regress-90596-001.js line 48: TypeError: Value undefined (result of expression obj.toSource) is not object.<br>
    389389</tt><br>
    390390<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
    … …  
    393393Testcase terminated with signal 0<br>
    394394Complete testcase output was:<br>
    395 [82437] ./js1_5/Object/regress-90596-002.js line 48: ReferenceError: Can't find variable: uneval<br>
     395[93494] ./js1_5/Object/regress-90596-002.js line 48: ReferenceError: Can't find variable: uneval<br>
    396396</tt><br>
    397397<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
    … …  
    400400Testcase terminated with signal 0<br>
    401401Complete testcase output was:<br>
    402 [82439] ./js1_5/Object/regress-96284-001.js line 49: TypeError: Value undefined (result of expression obj1.toSource) is not object.<br>
     402[93496] ./js1_5/Object/regress-96284-001.js line 49: TypeError: Value undefined (result of expression obj1.toSource) is not object.<br>
    403403</tt><br>
    404404<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
    … …  
    407407Testcase terminated with signal 0<br>
    408408Complete testcase output was:<br>
    409 [82440] ./js1_5/Object/regress-96284-002.js line 49: ReferenceError: Can't find variable: uneval<br>
     409[93497] ./js1_5/Object/regress-96284-002.js line 49: ReferenceError: Can't find variable: uneval<br>
    410410</tt><br>
    411411<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
    … …  
    416416BUGNUMBER: 44009<br>
    417417STATUS: Testing that we don't crash on obj.toSource()<br>
    418 [82445] ./js1_5/Regress/regress-44009.js line 60: TypeError: Value undefined (result of expression obj.toSource) is not object.<br>
    419 </tt><br>
    420 <a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-68498-003.js'>js1_5/Regress/regress-68498-003.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=68498' target='other_window'>Bug Number 68498</a><br>
     418[93502] ./js1_5/Regress/regress-44009.js line 60: TypeError: Value undefined (result of expression obj.toSource) is not object.<br>
     419</tt><br>
     420<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
    421421 [ <a href='#failure40'>Previous Failure</a> | <a href='#failure42'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    422 <tt>STATUS: Testing calling obj.eval(str)<br>
    423 Failure messages were:<br>
    424 FAILED!: [reported from test()] Testing calling obj.eval(str); currently at expect[1] within test -<br>
    425 FAILED!: [reported from test()] Type mismatch, expected type number, actual type boolean<br>
    426 FAILED!: [reported from test()] Expected value '43', Actual value 'false'<br>
    427 FAILED!: [reported from test()] <br>
    428 </tt><br>
    429 <a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
    430  [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    431422<tt>STATUS: Reassignment to a const is NOT an error per ECMA<br>
    432423Failure messages were:<br>
    … …  
    438429FAILED!: [reported from test()] <br>
    439430</tt><br>
    440 <a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
     431<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
     432 [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
     433<tt>Expected exit code 0, got 3<br>
     434Testcase terminated with signal 0<br>
     435Complete testcase output was:<br>
     436Testcase produced no output!</tt><br>
     437<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
    441438 [ <a href='#failure42'>Previous Failure</a> | <a href='#failure44'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    442439<tt>Expected exit code 0, got 3<br>
    443440Testcase terminated with signal 0<br>
    444441Complete testcase output was:<br>
    445 Testcase produced no output!</tt><br>
    446 <a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
     442[93528] ./js1_5/Regress/regress-127557.js line 75: ReferenceError: Can't find variable: clone<br>
     443</tt><br>
     444<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
    447445 [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    448446<tt>Expected exit code 0, got 3<br>
    449447Testcase terminated with signal 0<br>
    450448Complete testcase output was:<br>
    451 [82471] ./js1_5/Regress/regress-127557.js line 75: ReferenceError: Can't find variable: clone<br>
    452 </tt><br>
    453 <a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
     449[93537] ./js1_5/Regress/regress-172699.js line 61: URIError: URI error<br>
     450</tt><br>
     451<a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
    454452 [ <a href='#failure44'>Previous Failure</a> | <a href='#failure46'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    455 <tt>Expected exit code 0, got 3<br>
    456 Testcase terminated with signal 0<br>
    457 Complete testcase output was:<br>
    458 [82481] ./js1_5/Regress/regress-172699.js line 61: URIError: URI error<br>
    459 </tt><br>
    460 <a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
    461  [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    462453<tt>STATUS: Don't crash on extraneous arguments to str.match(), etc.<br>
    463454Failure messages were:<br>
    … …  
    509500FAILED!: [reported from test()] <br>
    510501</tt><br>
    511 <a name='failure47'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
     502<a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
     503 [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
     504<tt>Expected exit code 0, got 3<br>
     505Testcase terminated with signal 0<br>
     506Complete testcase output was:<br>
     507[93562] ./js1_5/Scope/regress-220584.js line 56: ReferenceError: Can't find variable: Script<br>
     508</tt><br>
     509<a name='failure47'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
    512510 [ <a href='#failure46'>Previous Failure</a> | <a href='#failure48'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    513 <tt>Expected exit code 0, got 3<br>
    514 Testcase terminated with signal 0<br>
    515 Complete testcase output was:<br>
    516 [82506] ./js1_5/Scope/regress-220584.js line 56: ReferenceError: Can't find variable: Script<br>
    517 </tt><br>
    518 <a name='failure48'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
    519  [ <a href='#failure47'>Previous Failure</a> | <a href='#failure49'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    520511<tt>STATUS: Testing scope after changing obj.__proto__<br>
    521512Failure messages were:<br>
    … …  
    528519FAILED!: [reported from test()] <br>
    529520</tt><br>
    530 <a name='failure49'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
    531  [ <a href='#failure48'>Previous Failure</a> | <a href='#failure50'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
     521<a name='failure48'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
     522 [ <a href='#failure47'>Previous Failure</a> | <a href='#failure49'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    532523<tt>STATUS: E4X should be enabled even when e4x=1 not specified<br>
    533524Failure messages were:<br>
    … …  
    539530FAILED!: <br>
    540531</tt><br>
    541 <a name='failure50'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
     532<a name='failure49'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
     533 [ <a href='#failure48'>Previous Failure</a> | <a href='#failure50'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
     534<tt>Expected exit code 0, got 3<br>
     535Testcase terminated with signal 0<br>
     536Complete testcase output was:<br>
     537Testcase produced no output!</tt><br>
     538<a name='failure50'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
    542539 [ <a href='#failure49'>Previous Failure</a> | <a href='#failure51'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    543540<tt>Expected exit code 0, got 3<br>
    … …  
    545542Complete testcase output was:<br>
    546543Testcase produced no output!</tt><br>
    547 <a name='failure51'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
     544<a name='failure51'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
    548545 [ <a href='#failure50'>Previous Failure</a> | <a href='#failure52'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    549 <tt>Expected exit code 0, got 3<br>
    550 Testcase terminated with signal 0<br>
    551 Complete testcase output was:<br>
    552 Testcase produced no output!</tt><br>
    553 <a name='failure52'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
    554  [ <a href='#failure51'>Previous Failure</a> | <a href='#failure53'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
    555546<tt>Expected exit code 0, got 3<br>
    556547Testcase terminated with signal 0<br>
    … …  
    559550STATUS: String static methods<br>
    560551STATUS: See https://bugzilla.mozilla.org/show_bug.cgi?id=304828<br>
    561 [82528] ./js1_6/String/regress-306591.js line 48: TypeError: Value undefined (result of expression String.split) is not object.<br>
     552[93584] ./js1_6/String/regress-306591.js line 48: TypeError: Value undefined (result of expression String.split) is not object.<br>
    562553</tt><br>
    563554</dl>
    … …  
    567558<a name='retest_list'></a>
    568559<h2>Retest List</h2><br>
    569 # Retest List, kjs, generated Thu Jan  3 00:46:35 2008.
     560# Retest List, kjs, generated Thu Mar  6 13:53:55 2008.
    570561# Original test base was: All tests.
    571 # 1127 of 1135 test(s) were completed, 52 failures reported.
     562# 1127 of 1135 test(s) were completed, 51 failures reported.
    572563ecma/TypeConversion/9.3.1-3.js
    573564ecma_2/Exceptions/function-001.js
    … …  
    610601js1_5/Object/regress-96284-002.js
    611602js1_5/Regress/regress-44009.js
    612 js1_5/Regress/regress-68498-003.js
    613603js1_5/Regress/regress-103602.js
    614604js1_5/Regress/regress-104077.js
Note: See TracChangeset for help on using the changeset viewer.