AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Make %ThrowTypeError% function(s) strict

Browse Source 
Bootstrapper previously created %ThrowTypeError% before the strict
function maps existed, so making that function strict required a small
amount of code reordering.

This fixes a few test262 tests, but we're still non-compliant due to the
fact that we have two functions instead of one (see issue 4034).

BUG=v8:4925
LOG=y

Review-Url: https://codereview.chromium.org/2006733004
Cr-Commit-Position: refs/heads/master@{#36526}
This commit is contained in:
adamk 2016-05-25 10:00:28 -07:00 committed by Commit bot
parent cfb4d1e6d7
commit d84dbc7125
2 changed files with 8 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/bootstrapper.cc
View File

@ -165,7 +165,7 @@ class Genesis BASE_EMBEDDED {
void CreateJSProxyMaps();
// Make the "arguments" and "caller" properties throw a TypeError on access.
void AddRestrictedFunctionProperties(Handle<Map> map);
void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
// Creates the global objects using the global proxy and the template passed
// in through the API. We call this regardless of whether we are building a
@ -609,9 +609,6 @@ Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {
Map::SetPrototype(sloppy_function_without_prototype_map, empty_function);
Map::SetPrototype(sloppy_function_map_writable_prototype_, empty_function);
// ES6 draft 03-17-2015, section 8.2.2 step 12
AddRestrictedFunctionProperties(empty_function_map);
return empty_function;
}
@ -666,7 +663,7 @@ Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic(
factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("ThrowTypeError"));
Handle<Code> code(isolate()->builtins()->builtin(builtin_name));
Handle<JSFunction> function =
factory()->NewFunctionWithoutPrototype(name, code);
factory()->NewFunctionWithoutPrototype(name, code, true);
function->shared()->DontAdaptArguments();
// %ThrowTypeError% must not have a name property.
@ -739,6 +736,10 @@ void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
// This map is installed in MakeFunctionInstancePrototypeWritable.
strict_function_map_writable_prototype_ =
CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE, empty);
// Now that the strict mode function map is available, set up the
// restricted "arguments" and "caller" getters.
AddRestrictedFunctionProperties(empty);
}
void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
@ -868,14 +869,14 @@ static void ReplaceAccessors(Handle<Map> map,
descriptors->Replace(idx, &descriptor);
}
void Genesis::AddRestrictedFunctionProperties(Handle<Map> map) {
void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
Handle<JSFunction> thrower = GetRestrictedFunctionPropertiesThrower();
Handle<AccessorPair> accessors = factory()->NewAccessorPair();
accessors->set_getter(*thrower);
accessors->set_setter(*thrower);
Handle<Map> map(empty->map());
ReplaceAccessors(map, factory()->arguments_string(), rw_attribs, accessors);
ReplaceAccessors(map, factory()->caller_string(), rw_attribs, accessors);
}

4
test/test262/test262.status
View File

@ -230,10 +230,6 @@
'built-ins/TypedArray/prototype/toString/detached-buffer': [FAIL],
'built-ins/TypedArray/prototype/values/detached-buffer': [FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=4925
'built-ins/ThrowTypeError/forbidden-arguments': [FAIL],
'built-ins/ThrowTypeError/forbidden-caller': [FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=4034
'built-ins/ThrowTypeError/unique-per-realm-function-proto': [FAIL],