[JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
authorcaitp@igalia.com <caitp@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 20 Oct 2016 15:00:43 +0000 (15:00 +0000)
committercaitp@igalia.com <caitp@igalia.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 20 Oct 2016 15:00:43 +0000 (15:00 +0000)
commit749c63dcb82d37b73cacd7ce7138622358609af9
treeaf7323cac1ef7d99db3ff6d3c6d137b1b475bd7f
parent48052dcc14cc728e4dc720846ed90e371f9dc0cc
[JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
https://bugs.webkit.org/show_bug.cgi?id=163714

Reviewed by Mark Lam.

JSTests:

Add missing test coverage that dynamically created
JSGeneratorFunctions can not be constructed.

* stress/generator-function-constructor.js:
(shouldThrow):

Source/JavaScriptCore:

According to CreateDynamicFunction() (https://tc39.github.io/ecma262/#sec-createdynamicfunction),
non-normal functions are not constructors. Previously, dynamically created functions would always
be constructible, and so it was possible to evaluate `new  (function*() {}.constructor())`,
and have it return an Iterator object.

This change selects a dynamically created function's ConstructAbility based on its parse mode instead.

* runtime/CodeCache.cpp:
(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@207618 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/generator-function-constructor.js
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/CodeCache.cpp