Commit 49a919a4 authored by barraclough@apple.com's avatar barraclough@apple.com

RegExpMatchesArray should not call [[put]]

https://bugs.webkit.org/show_bug.cgi?id=120317

Reviewed by Oliver Hunt.

This will call accessors on the JSObject/JSArray prototypes - so adding an accessor or read-only
property called index or input to either of these prototypes will result in broken behavior.

Source/JavaScriptCore: 

* runtime/RegExpMatchesArray.cpp:
(JSC::RegExpMatchesArray::reifyAllProperties):
    - put -> putDirect

LayoutTests: 

* fast/regex/lastIndex-expected.txt:
* fast/regex/script-tests/lastIndex.js:
    - Added test



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154612 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 89147735
2013-08-26 Gavin Barraclough <barraclough@apple.com>
RegExpMatchesArray should not call [[put]]
https://bugs.webkit.org/show_bug.cgi?id=120317
Reviewed by Oliver Hunt.
This will call accessors on the JSObject/JSArray prototypes - so adding an accessor or read-only
property called index or input to either of these prototypes will result in broken behavior.
* fast/regex/lastIndex-expected.txt:
* fast/regex/script-tests/lastIndex.js:
- Added test
2013-08-26 Gyuyoung Kim <gyuyoung.kim@samsung.com>
Unreviewed, EFL gardening. EFL WK1 DRT doesn't support exif-orientation tests
......@@ -24,6 +24,8 @@ PASS Object.defineProperty(/x/, 'lastIndex', {writable:false}).exec('x') is ["x"
PASS Object.defineProperty(/x/g, 'lastIndex', {writable:false}).exec('') threw exception TypeError: Attempted to assign to readonly property..
PASS Object.defineProperty(/x/g, 'lastIndex', {writable:false}).exec('x') threw exception TypeError: Attempted to assign to readonly property..
PASS var re = /x/; Object.freeze(re); Object.isFrozen(re); is true
PASS /x/.exec("x").input is "x"
PASS /x/.exec("x").input is "x"
PASS successfullyParsed is true
TEST COMPLETE
......
......@@ -46,3 +46,8 @@ shouldThrow("Object.defineProperty(/x/g, 'lastIndex', {writable:false}).exec('x'
// Should be able to freeze a regular expression object.
shouldBeTrue("var re = /x/; Object.freeze(re); Object.isFrozen(re);");
// Presence of setter on prototype chain should not affect RegexpMatchesArray
shouldBe('/x/.exec("x").input', '"x"');
Object.defineProperty(Object.prototype, "input", { set: function(){} });
shouldBe('/x/.exec("x").input', '"x"');
2013-08-26 Gavin Barraclough <barraclough@apple.com>
RegExpMatchesArray should not call [[put]]
https://bugs.webkit.org/show_bug.cgi?id=120317
Reviewed by Oliver Hunt.
This will call accessors on the JSObject/JSArray prototypes - so adding an accessor or read-only
property called index or input to either of these prototypes will result in broken behavior.
* runtime/RegExpMatchesArray.cpp:
(JSC::RegExpMatchesArray::reifyAllProperties):
- put -> putDirect
2013-08-24 Filip Pizlo <fpizlo@apple.com>
FloatTypedArrayAdaptor::toJSValue should almost certainly not use jsNumber() since that attempts int conversions
......
......@@ -92,9 +92,8 @@ void RegExpMatchesArray::reifyAllProperties(ExecState* exec)
}
}
PutPropertySlot slot;
JSArray::put(this, exec, exec->propertyNames().index, jsNumber(m_result.start), slot);
JSArray::put(this, exec, exec->propertyNames().input, m_input.get(), slot);
putDirect(exec->vm(), exec->propertyNames().index, jsNumber(m_result.start));
putDirect(exec->vm(), exec->propertyNames().input, m_input.get());
m_state = ReifiedAll;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment