Assertion failure for exception in "prototype" property getter and Reflect.construct
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 29 Apr 2016 20:01:42 +0000 (20:01 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 29 Apr 2016 20:01:42 +0000 (20:01 +0000)
commitc5844462d0dcdea98391e5ed0a2cc1810b6bb6d4
tree32c32779b931350a26bd2818c7631f7af5c1b30b
parent8b10a349720a3e4a84e7e1dce5964a8802300ee7
Assertion failure for exception in "prototype" property getter and Reflect.construct
https://bugs.webkit.org/show_bug.cgi?id=157084

Reviewed by Mark Lam.

InternalFunction::createSubclassStrucuture may throw exceptions because it performs [[Get]] to
look up the "prototype" object. The current assertion is invalid.
We also found that Object constructor is not aware of new.target. This is filed[1].

[1]: https://bugs.webkit.org/show_bug.cgi?id=157196

* runtime/InternalFunction.cpp:
(JSC::InternalFunction::createSubclassStructure):
* tests/stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Added.
(shouldThrow):
(bf):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200257 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/InternalFunction.cpp
Source/JavaScriptCore/tests/stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js [new file with mode: 0644]