RegExpObject::defineOwnProperty() does not need to compare values if no descriptor...
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 19 Oct 2017 01:12:56 +0000 (01:12 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 19 Oct 2017 01:12:56 +0000 (01:12 +0000)
https://bugs.webkit.org/show_bug.cgi?id=177600
<rdar://problem/34710985>

Reviewed by Saam Barati.

JSTests:

* stress/regress-177600.js: Added.

Source/JavaScriptCore:

According to http://www.ecma-international.org/ecma-262/8.0/#sec-validateandapplypropertydescriptor,
section 9.1.6.3-7.a.ii, we should only check if the value is the same if the
descriptor value is present.

* runtime/RegExpObject.cpp:
(JSC::RegExpObject::defineOwnProperty):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@223645 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/regress-177600.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/RegExpObject.cpp

index 7c4c39e..75aea45 100644 (file)
@@ -1,5 +1,15 @@
 2017-10-18  Mark Lam  <mark.lam@apple.com>
 
+        RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=177600
+        <rdar://problem/34710985>
+
+        Reviewed by Saam Barati.
+
+        * stress/regress-177600.js: Added.
+
+2017-10-18  Mark Lam  <mark.lam@apple.com>
+
         The compiler should always register a structure when it adds its transitionWatchPointSet.
         https://bugs.webkit.org/show_bug.cgi?id=178420
         <rdar://problem/34814024>
diff --git a/JSTests/stress/regress-177600.js b/JSTests/stress/regress-177600.js
new file mode 100644 (file)
index 0000000..9590c52
--- /dev/null
@@ -0,0 +1,5 @@
+// This test passes if it does not crash.
+
+var regexp5 = new RegExp(/\t%%/);
+Object.defineProperty(regexp5, "lastIndex" ,{value:"\w?\B", writable:false});
+Object.seal(regexp5);
index 458a4f8..5b0ff42 100644 (file)
@@ -1,3 +1,18 @@
+2017-10-18  Mark Lam  <mark.lam@apple.com>
+
+        RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
+        https://bugs.webkit.org/show_bug.cgi?id=177600
+        <rdar://problem/34710985>
+
+        Reviewed by Saam Barati.
+
+        According to http://www.ecma-international.org/ecma-262/8.0/#sec-validateandapplypropertydescriptor,
+        section 9.1.6.3-7.a.ii, we should only check if the value is the same if the
+        descriptor value is present.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+
 2017-10-18  Keith Miller  <keith_miller@apple.com>
 
         Setup WebCore build to start using unified sources.
index d6b1553..61555f2 100644 (file)
@@ -120,7 +120,7 @@ bool RegExpObject::defineOwnProperty(JSObject* object, ExecState* exec, Property
         if (!regExp->m_lastIndexIsWritable) {
             if (descriptor.writablePresent() && descriptor.writable())
                 return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
-            if (!sameValue(exec, regExp->getLastIndex(), descriptor.value()))
+            if (descriptor.value() && !sameValue(exec, regExp->getLastIndex(), descriptor.value()))
                 return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyChangeError));
             return true;
         }