Function.prototype.caller shouldn't return generator bodies
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 15 Apr 2018 17:38:01 +0000 (17:38 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 15 Apr 2018 17:38:01 +0000 (17:38 +0000)
https://bugs.webkit.org/show_bug.cgi?id=184630

Reviewed by Yusuke Suzuki.
JSTests:

* stress/function-caller-async-arrow-function-body.js: Added.
* stress/function-caller-async-function-body.js: Added.
* stress/function-caller-async-generator-body.js: Added.
* stress/function-caller-generator-body.js: Added.
* stress/function-caller-generator-method-body.js: Added.

Source/JavaScriptCore:

Function.prototype.caller no longer returns generator bodies. Those are meant to be
private.

Also added some builtin debugging tools so that it's easier to do the investigation that I
did.

* builtins/BuiltinNames.h:
* runtime/JSFunction.cpp:
(JSC::JSFunction::callerGetter):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncBuiltinDescribe):
* runtime/JSGlobalObjectFunctions.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230662 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12 files changed:
JSTests/ChangeLog
JSTests/stress/function-caller-async-arrow-function-body.js [new file with mode: 0644]
JSTests/stress/function-caller-async-function-body.js [new file with mode: 0644]
JSTests/stress/function-caller-async-generator-body.js [new file with mode: 0644]
JSTests/stress/function-caller-generator-body.js [new file with mode: 0644]
JSTests/stress/function-caller-generator-method-body.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/builtins/BuiltinNames.h
Source/JavaScriptCore/runtime/JSFunction.cpp
Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h

index a22ef8b..a3a2643 100644 (file)
@@ -1,3 +1,16 @@
+2018-04-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Function.prototype.caller shouldn't return generator bodies
+        https://bugs.webkit.org/show_bug.cgi?id=184630
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/function-caller-async-arrow-function-body.js: Added.
+        * stress/function-caller-async-function-body.js: Added.
+        * stress/function-caller-async-generator-body.js: Added.
+        * stress/function-caller-generator-body.js: Added.
+        * stress/function-caller-generator-method-body.js: Added.
+
 2018-04-12  Tomas Popela  <tpopela@redhat.com>
 
         Unreviewed, skip JIT tests if it isn't enabled
diff --git a/JSTests/stress/function-caller-async-arrow-function-body.js b/JSTests/stress/function-caller-async-arrow-function-body.js
new file mode 100644 (file)
index 0000000..fcaae96
--- /dev/null
@@ -0,0 +1,26 @@
+//@ runDefault
+
+(function thingy() {
+    function bar()
+    {
+        return bar.caller;
+    }
+    
+    var ok = false;
+    var badError = null;
+    var foo = async () => {
+        try {
+            bar();
+            ok = true;
+        } catch (e) {
+            if (e.toString() != "TypeError: Function.caller used to retrieve async function body")
+                badError = e;
+        }
+    }
+    
+    foo();
+    if (ok)
+        throw "Error: did not throw error";
+    if (badError)
+        throw "Bad error: " + badError;
+})();
diff --git a/JSTests/stress/function-caller-async-function-body.js b/JSTests/stress/function-caller-async-function-body.js
new file mode 100644 (file)
index 0000000..9e3273c
--- /dev/null
@@ -0,0 +1,27 @@
+//@ runDefault
+
+(function thingy() {
+    function bar()
+    {
+        return bar.caller;
+    }
+    
+    var ok = false;
+    var badError = null;
+    async function foo()
+    {
+        try {
+            bar();
+            ok = true;
+        } catch (e) {
+            if (e.toString() != "TypeError: Function.caller used to retrieve async function body")
+                badError = e;
+        }
+    }
+    
+    foo();
+    if (ok)
+        throw "Error: did not throw error";
+    if (badError)
+        throw "Bad error: " + badError;
+})();
diff --git a/JSTests/stress/function-caller-async-generator-body.js b/JSTests/stress/function-caller-async-generator-body.js
new file mode 100644 (file)
index 0000000..6801a2d
--- /dev/null
@@ -0,0 +1,27 @@
+//@ runDefault
+
+(function thingy() {
+    function bar()
+    {
+        return bar.caller;
+    }
+    
+    var ok = false;
+    var badError = null;
+    async function* foo()
+    {
+        try {
+            bar();
+            ok = true;
+        } catch (e) {
+            if (e.toString() != "TypeError: Function.caller used to retrieve generator body")
+                badError = e;
+        }
+    }
+    
+    foo().next();
+    if (ok)
+        throw "Error: did not throw error";
+    if (badError)
+        throw "Bad error: " + badError;
+})();
diff --git a/JSTests/stress/function-caller-generator-body.js b/JSTests/stress/function-caller-generator-body.js
new file mode 100644 (file)
index 0000000..8b9d10f
--- /dev/null
@@ -0,0 +1,24 @@
+//@ runDefault
+
+(function thingy() {
+    function bar()
+    {
+        return bar.caller;
+    }
+    
+    function* foo()
+    {
+        bar();
+    }
+    
+    var ok = false;
+    try {
+        foo().next();
+        ok = true;
+    } catch (e) {
+        if (e.toString() != "TypeError: Function.caller used to retrieve generator body")
+            throw "Error: bad error: " + e;
+    }
+    if (ok)
+        throw "Error: did not throw error";
+})();
diff --git a/JSTests/stress/function-caller-generator-method-body.js b/JSTests/stress/function-caller-generator-method-body.js
new file mode 100644 (file)
index 0000000..1d837ee
--- /dev/null
@@ -0,0 +1,26 @@
+//@ runDefault
+
+(function thingy() {
+    function bar()
+    {
+        return bar.caller;
+    }
+    
+    class C {
+        *foo()
+        {
+            bar();
+        }
+    }
+        
+    var ok = false;
+    try {
+        new C().foo().next();
+        ok = true;
+    } catch (e) {
+        if (e.toString() != "TypeError: Function.caller used to retrieve generator body")
+            throw "Error: bad error: " + e;
+    }
+    if (ok)
+        throw "Error: did not throw error";
+})();
index a2e8a8a..4f1d38a 100644 (file)
@@ -1,3 +1,25 @@
+2018-04-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Function.prototype.caller shouldn't return generator bodies
+        https://bugs.webkit.org/show_bug.cgi?id=184630
+
+        Reviewed by Yusuke Suzuki.
+        
+        Function.prototype.caller no longer returns generator bodies. Those are meant to be
+        private.
+        
+        Also added some builtin debugging tools so that it's easier to do the investigation that I
+        did.
+
+        * builtins/BuiltinNames.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::callerGetter):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncBuiltinDescribe):
+        * runtime/JSGlobalObjectFunctions.h:
+
 2018-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [DFG] Remove duplicate 32bit ProfileType implementation
index 071eb49..198fd1c 100644 (file)
@@ -83,6 +83,7 @@ namespace JSC {
     macro(typedArrayGetOriginalConstructor) \
     macro(typedArraySubarrayCreate) \
     macro(BuiltinLog) \
+    macro(BuiltinDescribe) \
     macro(homeObject) \
     macro(templateRegistryKey) \
     macro(enqueueJob) \
index 95c7490..deb1a67 100644 (file)
@@ -366,9 +366,34 @@ EncodedJSValue JSFunction::callerGetter(ExecState* exec, EncodedJSValue thisValu
     // Firefox returns null for native code callers, so we match that behavior.
     if (function->isHostOrBuiltinFunction())
         return JSValue::encode(jsNull());
-    if (!function->jsExecutable()->isStrictMode())
-        return JSValue::encode(caller);
-    return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Function.caller used to retrieve strict caller")));
+    SourceParseMode parseMode = function->jsExecutable()->parseMode();
+    switch (parseMode) {
+    case SourceParseMode::GeneratorBodyMode:
+    case SourceParseMode::AsyncGeneratorBodyMode:
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Function.caller used to retrieve generator body")));
+    case SourceParseMode::AsyncFunctionBodyMode:
+    case SourceParseMode::AsyncArrowFunctionBodyMode:
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Function.caller used to retrieve async function body")));
+    case SourceParseMode::NormalFunctionMode:
+    case SourceParseMode::GeneratorWrapperFunctionMode:
+    case SourceParseMode::GetterMode:
+    case SourceParseMode::SetterMode:
+    case SourceParseMode::MethodMode:
+    case SourceParseMode::ArrowFunctionMode:
+    case SourceParseMode::AsyncFunctionMode:
+    case SourceParseMode::AsyncMethodMode:
+    case SourceParseMode::AsyncArrowFunctionMode:
+    case SourceParseMode::ProgramMode:
+    case SourceParseMode::ModuleAnalyzeMode:
+    case SourceParseMode::ModuleEvaluateMode:
+    case SourceParseMode::AsyncGeneratorWrapperFunctionMode:
+    case SourceParseMode::AsyncGeneratorWrapperMethodMode:
+    case SourceParseMode::GeneratorWrapperMethodMode:
+        if (!function->jsExecutable()->isStrictMode())
+            return JSValue::encode(caller);
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Function.caller used to retrieve strict caller")));
+    }
+    RELEASE_ASSERT_NOT_REACHED();
 }
 
 bool JSFunction::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
index 056a5cf..a483177 100644 (file)
@@ -785,6 +785,7 @@ putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Construct
         putDirectWithoutTransition(vm, vm.propertyNames->Loader, m_moduleLoader.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 
     JSFunction* builtinLog = JSFunction::create(vm, this, 1, vm.propertyNames->emptyIdentifier.string(), globalFuncBuiltinLog);
+    JSFunction* builtinDescribe = JSFunction::create(vm, this, 1, vm.propertyNames->emptyIdentifier.string(), globalFuncBuiltinDescribe);
 
     JSFunction* privateFuncAbs = JSFunction::create(vm, this, 0, String(), mathProtoFuncAbs, AbsIntrinsic);
     JSFunction* privateFuncFloor = JSFunction::create(vm, this, 0, String(), mathProtoFuncFloor, FloorIntrinsic);
@@ -875,6 +876,7 @@ putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Construct
         GlobalPropertyInfo(vm.propertyNames->builtinNames().hasInstanceBoundFunctionPrivateName(), privateFuncHasInstanceBoundFunction, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().instanceOfPrivateName(), privateFuncInstanceOf, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().BuiltinLogPrivateName(), builtinLog, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().BuiltinDescribePrivateName(), builtinDescribe, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberPrivateName(), numberConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().RegExpPrivateName(), m_regExpConstructor.get(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
         GlobalPropertyInfo(vm.propertyNames->builtinNames().StringPrivateName(), stringConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
index f457dca..7313673 100644 (file)
@@ -774,6 +774,11 @@ EncodedJSValue JSC_HOST_CALL globalFuncBuiltinLog(ExecState* exec)
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL globalFuncBuiltinDescribe(ExecState* exec)
+{
+    return JSValue::encode(jsString(exec, toString(exec->argument(0))));
+}
+
 EncodedJSValue JSC_HOST_CALL globalFuncImportModule(ExecState* exec)
 {
     VM& vm = exec->vm();
index b6799e2..f7696dc 100644 (file)
@@ -52,6 +52,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState*);
 EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState*);
 EncodedJSValue JSC_HOST_CALL globalFuncHostPromiseRejectionTracker(ExecState*);
 EncodedJSValue JSC_HOST_CALL globalFuncBuiltinLog(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncBuiltinDescribe(ExecState*);
 EncodedJSValue JSC_HOST_CALL globalFuncImportModule(ExecState*);
 EncodedJSValue JSC_HOST_CALL globalFuncPropertyIsEnumerable(ExecState*);