[ES6] Arrow function. Issue in access to this after eval('super()') within constructor

https://bugs.webkit.org/show_bug.cgi?id=171543

Reviewed by Saam Barati.

JSTests:

* stress/arrowfunction-lexical-bind-supercall-4.js:
(J):
(K):

Source/JavaScriptCore:

Current patch force to use 'this' within arrow function or eval
from virtual scope each time, instead of using thisRegister.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::ensureThis):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@216329 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 54e2446..fa9deb4 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,14 @@
+2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
+
+        [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
+        https://bugs.webkit.org/show_bug.cgi?id=171543
+
+        Reviewed by Saam Barati.
+
+        * stress/arrowfunction-lexical-bind-supercall-4.js:
+        (J):
+        (K):
+
 2017-05-05  Saam Barati  <sbarati@apple.com>
 
         putDirectIndex does not properly do defineOwnProperty

diff --git a/JSTests/stress/arrowfunction-lexical-bind-supercall-4.js b/JSTests/stress/arrowfunction-lexical-bind-supercall-4.js
index 21d8f19..fb887c2 100644 (file)
--- a/JSTests/stress/arrowfunction-lexical-bind-supercall-4.js
+++ b/JSTests/stress/arrowfunction-lexical-bind-supercall-4.js
@@ -5,6 +5,7 @@ var testCase = function (actual, expected, message) {
 };
 
 var testValue  = 'test-value';
+var testIdValue  = 'test-id-value';
 
 var A = class A {
     constructor() {
@@ -160,3 +161,38 @@ testCase(ic.idValue, testValue, 'Error: not correct binding superProperty&this i
 for (var i=0; i < 1000; i++) {
     testException(I, false, i);
 }
+
+class J extends A {
+    constructor (beforeSuper) {
+      if (beforeSuper) {
+        const arr = () => { eval('super()');  this._id = testIdValue; };
+        arr();
+      }
+      testCase(this.idValue, testValue, "Error: super() should create this and put value into idValue property");
+    }
+};
+
+let jc = new J(true);
+testCase(jc.idValue, testValue, 'Error: not correct binding superProperty&this in constructor');
+
+for (var i=0; i < 1000; i++) {
+    testException(J, false, i);
+}
+
+class K extends A {
+    constructor (beforeSuper) {
+      if (beforeSuper) {
+        const arr = () => { (() => () => eval('super()'))()();  (() => { this._id = testIdValue; })(); };
+        arr();
+      }
+        testCase(this.idValue, testValue, "Error: super() should create this and put value into idValue property");
+    }
+};
+
+let kc = new K(true);
+testCase(kc.idValue, testValue, 'Error: not correct binding superProperty&this in constructor');
+
+for (var i=0; i < 1000; i++) {
+    testException(K, false, i);
+}
+

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 253b8ba..5fe3c29 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,16 @@
+2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
+
+        [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
+        https://bugs.webkit.org/show_bug.cgi?id=171543
+
+        Reviewed by Saam Barati.
+
+        Current patch force to use 'this' within arrow function or eval 
+        from virtual scope each time, instead of using thisRegister.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::ensureThis):
+
 2017-05-05  Keith Miller  <keith_miller@apple.com>
 
         Put does not properly consult the prototype chain

diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index c70415b..1585e13 100644 (file)
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -4603,7 +4603,7 @@ RegisterID* BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexica
 
 RegisterID* BytecodeGenerator::ensureThis()
 {
-    if (constructorKind() == ConstructorKind::Extends && needsToUpdateArrowFunctionContext() && isSuperCallUsedInInnerArrowFunction())
+    if ((constructorKind() == ConstructorKind::Extends || isDerivedConstructorContext())  && needsToUpdateArrowFunctionContext() && isSuperCallUsedInInnerArrowFunction())
         emitLoadThisFromArrowFunctionLexicalEnvironment();
 
     if (constructorKind() == ConstructorKind::Extends || isDerivedConstructorContext())