Function object should convert params to string before throw a parsing error
authoryusukesuzuki@slowstart.org <yusukesuzuki@slowstart.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 1 Sep 2018 08:03:43 +0000 (08:03 +0000)
committeryusukesuzuki@slowstart.org <yusukesuzuki@slowstart.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 1 Sep 2018 08:03:43 +0000 (08:03 +0000)
commitd9fabcfbabf1404dd1acb484027781a8b73fea91
treea99fb5d4878c1916668a4bf9c8689c43fb432b45
parentc4a054331d179d9b0aa84d0300aa3420a3e8cba3
Function object should convert params to string before throw a parsing error
https://bugs.webkit.org/show_bug.cgi?id=188874

Reviewed by Darin Adler.

JSTests:

* stress/function-body-to-string-before-parameter-syntax-check.js: Added.
(shouldThrow):

Source/JavaScriptCore:

ToString operation onto the `body` of the Function constructor should be performed
before checking syntax correctness of the parameters.

* runtime/FunctionConstructor.cpp:
(JSC::constructFunctionSkippingEvalEnabledCheck):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@235582 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/function-body-to-string-before-parameter-syntax-check.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/FunctionConstructor.cpp