[ES6] RegExp.prototype.@@replace should use @isObject instead of `instanceof` for...
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 29 Apr 2016 11:36:26 +0000 (11:36 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 29 Apr 2016 11:36:26 +0000 (11:36 +0000)
https://bugs.webkit.org/show_bug.cgi?id=157124

Reviewed by Keith Miller.

Use @isObject instead of `instanceof @Object`.
The `instanceof` check is not enough to check Object Type.
This fix itself is the same to r199647, and this patch is for RegExp.prototype.@@replace.

* builtins/RegExpPrototype.js:
(replace):
* tests/stress/regexp-replace-in-other-realm-should-work.js: Added.
(shouldBe):
* tests/stress/regexp-replace-should-work-with-objects-not-inheriting-object-prototype.js: Added.
(shouldBe):
(regexp.exec):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200239 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/builtins/RegExpPrototype.js
Source/JavaScriptCore/tests/stress/regexp-replace-in-other-realm-should-work.js [new file with mode: 0644]
Source/JavaScriptCore/tests/stress/regexp-replace-should-work-with-objects-not-inheriting-object-prototype.js [new file with mode: 0644]

index 3009a28..0767458 100644 (file)
@@ -1,3 +1,22 @@
+2016-04-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] RegExp.prototype.@@replace should use @isObject instead of `instanceof` for object guard
+        https://bugs.webkit.org/show_bug.cgi?id=157124
+
+        Reviewed by Keith Miller.
+
+        Use @isObject instead of `instanceof @Object`.
+        The `instanceof` check is not enough to check Object Type.
+        This fix itself is the same to r199647, and this patch is for RegExp.prototype.@@replace.
+
+        * builtins/RegExpPrototype.js:
+        (replace):
+        * tests/stress/regexp-replace-in-other-realm-should-work.js: Added.
+        (shouldBe):
+        * tests/stress/regexp-replace-should-work-with-objects-not-inheriting-object-prototype.js: Added.
+        (shouldBe):
+        (regexp.exec):
+
 2016-04-29  Yoav Weiss  <yoav@yoav.ws>
 
         Move ResourceTiming behind a runtime flag
index f0cdb14..6d6fafb 100644 (file)
@@ -197,7 +197,7 @@ function replace(strArg, replace)
         return result + replacement.substring(lastStart);
     }
 
-    if (!(this instanceof @Object))
+    if (!@isObject(this))
         throw new @TypeError("RegExp.prototype.@@replace requires that |this| be an Object");
 
     let regexp = this;
diff --git a/Source/JavaScriptCore/tests/stress/regexp-replace-in-other-realm-should-work.js b/Source/JavaScriptCore/tests/stress/regexp-replace-in-other-realm-should-work.js
new file mode 100644 (file)
index 0000000..0e8cc5d
--- /dev/null
@@ -0,0 +1,10 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${String(actual)}`);
+}
+
+var regexp = /Hello/;
+var string = "Hello";
+var otherRealm = createGlobalObject();
+shouldBe(otherRealm.RegExp.prototype[Symbol.replace].call(regexp, string, "OK"), "OK")
+
diff --git a/Source/JavaScriptCore/tests/stress/regexp-replace-should-work-with-objects-not-inheriting-object-prototype.js b/Source/JavaScriptCore/tests/stress/regexp-replace-should-work-with-objects-not-inheriting-object-prototype.js
new file mode 100644 (file)
index 0000000..6a17825
--- /dev/null
@@ -0,0 +1,11 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${String(actual)}`);
+}
+var regexp = Object.create(null);
+regexp.reg = /Hello/;
+regexp.exec = function (value) {
+    return regexp.reg.exec(value);
+};
+var string = "Hello";
+shouldBe(RegExp.prototype[Symbol.replace].call(regexp, string, "OK"), "OK")