Unreviewed, rolling out r251940.
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Nov 2019 00:00:04 +0000 (00:00 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Nov 2019 00:00:04 +0000 (00:00 +0000)
https://bugs.webkit.org/show_bug.cgi?id=203920

"it introduced test262 failures" (Requested by rkirsling on
#webkit).

Reverted changeset:

"[[HasProperty]] result of Proxy in prototype chain is
ignored"
https://bugs.webkit.org/show_bug.cgi?id=203560
https://trac.webkit.org/changeset/251940

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@252158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/proxy-get-prototype-of.js
JSTests/test262/expectations.yaml
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSObjectInlines.h

index d3a23d3..aec63ee 100644 (file)
@@ -1,3 +1,18 @@
+2019-11-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r251940.
+        https://bugs.webkit.org/show_bug.cgi?id=203920
+
+        "it introduced test262 failures" (Requested by rkirsling on
+        #webkit).
+
+        Reverted changeset:
+
+        "[[HasProperty]] result of Proxy in prototype chain is
+        ignored"
+        https://bugs.webkit.org/show_bug.cgi?id=203560
+        https://trac.webkit.org/changeset/251940
+
 2019-11-04  Saam Barati  <sbarati@apple.com>
 
         Don't use memmove/memcpy/memset for memory that can be scanned concurrently
index f6909ed..de01de4 100644 (file)
@@ -389,6 +389,7 @@ function assert(b) {
     let called = false;
     let handler = {
         getPrototypeOf: function(theTarget) {
+            assert(theTarget === target);
             called = true;
             return proto;
         },
@@ -399,8 +400,9 @@ function assert(b) {
     
     let proxy = new Proxy(target, handler);
     for (let i = 0; i < 500; i++) {
-        let result = 1 in proxy;
-        assert(!called);
+        let result = "x" in proxy;
+        assert(called);
+        called = false;
     }
 }
 
index f1751c4..7f45f19 100644 (file)
@@ -633,6 +633,12 @@ test/built-ins/Array/proto-from-ctor-realm-zero.js:
 test/built-ins/Array/prototype/filter/target-array-with-non-writable-property.js:
   default: 'TypeError: Attempted to assign to readonly property.'
   strict mode: 'TypeError: Attempted to assign to readonly property.'
+test/built-ins/Array/prototype/indexOf/calls-only-has-on-prototype-after-length-zeroed.js:
+  default: 'Test262Error: [[GetPrototypeOf]] trap called'
+  strict mode: 'Test262Error: [[GetPrototypeOf]] trap called'
+test/built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js:
+  default: 'Test262Error: [[GetPrototypeOf]] trap called'
+  strict mode: 'Test262Error: [[GetPrototypeOf]] trap called'
 test/built-ins/Array/prototype/map/target-array-with-non-writable-property.js:
   default: 'TypeError: Attempted to assign to readonly property.'
   strict mode: 'TypeError: Attempted to assign to readonly property.'
@@ -1147,6 +1153,9 @@ test/built-ins/Proxy/construct/return-not-object-throws-undefined-realm.js:
 test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
   default: 'Test262Error: Expected a TypeError but got a TypeError'
   strict mode: 'Test262Error: Expected a TypeError but got a TypeError'
+test/built-ins/Proxy/has/call-in-prototype.js:
+  default: 'Test262Error: [[GetPrototypeOf]] trap called'
+  strict mode: 'Test262Error: [[GetPrototypeOf]] trap called'
 test/built-ins/Proxy/revocable/revocation-function-name.js:
   default: 'Test262Error: obj should have an own property name'
   strict mode: 'Test262Error: obj should have an own property name'
index 0076250..3bd78a6 100644 (file)
@@ -1,3 +1,18 @@
+2019-11-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r251940.
+        https://bugs.webkit.org/show_bug.cgi?id=203920
+
+        "it introduced test262 failures" (Requested by rkirsling on
+        #webkit).
+
+        Reverted changeset:
+
+        "[[HasProperty]] result of Proxy in prototype chain is
+        ignored"
+        https://bugs.webkit.org/show_bug.cgi?id=203560
+        https://trac.webkit.org/changeset/251940
+
 2019-11-05  Mark Lam  <mark.lam@apple.com>
 
         WTF::RunLoop should not depend on isMainThread() idiom.
index 6027f19..f3f5ab5 100644 (file)
@@ -126,8 +126,6 @@ ALWAYS_INLINE bool JSObject::getPropertySlot(JSGlobalObject* globalObject, unsig
         RETURN_IF_EXCEPTION(scope, false);
         if (hasSlot)
             return true;
-        if (object->type() == ProxyObjectType && slot.internalMethodType() == PropertySlot::InternalMethodType::HasProperty)
-            return false;
         JSValue prototype;
         if (LIKELY(structure->classInfo()->methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
             prototype = object->getPrototypeDirect(vm);
@@ -161,8 +159,6 @@ ALWAYS_INLINE bool JSObject::getNonIndexPropertySlot(JSGlobalObject* globalObjec
             RETURN_IF_EXCEPTION(scope, false);
             if (hasSlot)
                 return true;
-            if (object->type() == ProxyObjectType && slot.internalMethodType() == PropertySlot::InternalMethodType::HasProperty)
-                return false;
         }
         JSValue prototype;
         if (LIKELY(structure->classInfo()->methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))