Bug 210267

Summary: ProxyObject::defineOwnProperty() should conditionally throw on falsy trap result
Product: WebKit Reporter: Alexey Shvayka <ashvayka>
Component: JavaScriptCoreAssignee: Alexey Shvayka <ashvayka>
Status: RESOLVED FIXED    
Severity: Trivial CC: ews-watchlist, keith_miller, mark.lam, msaboff, nisl_grammarly1, ross.kirsling, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch
none
Patch
none
Patch
none
Patch none

Alexey Shvayka
Reported 2020-04-09 05:35:46 PDT
Test case: Object.defineProperty(new Proxy({}, {defineProperty: () => false}), "foo", {}) Expected: TypeError thrown Actual: Proxy object returned ECMA262: https://tc39.es/ecma262/#sec-object.defineproperty (step 4) Test262: https://test262.report/browse/built-ins/Proxy/defineProperty/trap-is-undefined-target-is-proxy.js
Attachments
Patch (4.97 KB, patch)
2020-04-09 06:50 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Patch (5.04 KB, patch)
2020-04-09 08:22 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Patch (5.13 KB, patch)
2020-04-09 08:30 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Patch (22.65 KB, patch)
2020-04-09 12:37 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Show Obsolete (3) View All Add attachment proposed patch, testcase, etc.
Alexey Shvayka
Comment 1 2020-04-09 06:50:50 PDT
Created attachment 395945 [details] Patch
Alexey Shvayka
Comment 2 2020-04-09 08:22:51 PDT
Created attachment 395952 [details] Patch Add spec link to ChangeLog.
Alexey Shvayka
Comment 3 2020-04-09 08:30:41 PDT
Created attachment 395956 [details] Patch Rebase patch.
Ross Kirsling
Comment 4 2020-04-09 11:20:32 PDT
Comment on attachment 395956 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395956&action=review r=me with comment > Source/JavaScriptCore/ChangeLog:12 > + Also replaces 2 recently added throwTypeError() calls with throwVMTypeError(), > + as the latter seems to be preferred in ProxyObject. Seems like we should go the other way if we're not using the result, since throwVMTypeError just encodes the JSValue.
Alexey Shvayka
Comment 5 2020-04-09 12:37:15 PDT
Created attachment 395990 [details] Patch Set reviewer and replace throwVMTypeError() with unused results.
EWS
Comment 6 2020-04-09 13:40:43 PDT
Committed r259822: <https://trac.webkit.org/changeset/259822> All reviewed patches have been landed. Closing bug and clearing flags on attachment 395990 [details].
Radar WebKit Bug Importer
Comment 7 2020-04-09 13:41:19 PDT
<rdar://problem/61537090>
Alexey Shvayka
Comment 8 2020-09-29 12:44:16 PDT
*** Bug 217051 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.