-
barraclough@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=79588 Reviewed by Oliver Hunt. In the case of [[Get]], this is a pretty trivial bug - just don't wrap primitives at the point you call a getter. For setters, this is a little more involved, since we have already wrapped the value up in a synthesized object. Stop doing so. There is also a further subtely, that in strict mode all attempts to create a new data property on the object should throw. Source/JavaScriptCore: * runtime/JSCell.cpp: (JSC::JSCell::put): - [[Put]] to a string primitive should use JSValue::putToPrimitive. * runtime/JSObject.cpp: (JSC::JSObject::put): - Remove static function called in one place. * runtime/JSObject.h: (JSC::JSValue::put): - [[Put]] to a non-cell JSValue should use JSValue::putToPrimitive. * runtime/JSValue.cpp: (JSC::JSValue::synthesizePrototype): - Add support for synthesizing the prototype of strings. (JSC::JSValue::putToPrimitive): - Added, implements [[Put]] for primitive bases, per 8.7.2. * runtime/JSValue.h: (JSValue): - Add declaration for JSValue::putToPrimitive. * runtime/PropertySlot.cpp: (JSC::PropertySlot::functionGetter): - Don't call ToObject on primitive this values. LayoutTests: * fast/js/mozilla/strict/15.5.5.1-expected.txt: * fast/js/primitive-property-access-edge-cases-expected.txt: * fast/js/read-modify-eval-expected.txt: * fast/js/script-tests/primitive-property-access-edge-cases.js: * fast/js/script-tests/read-modify-eval.js: - Added new test cases & updated test results. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@109177 268f45cc-cd09-0410-ab3c-d52691b4dbfc
dca6b2ea