| Summary: | ProxyObject::defineOwnProperty() should conditionally throw on falsy trap result | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Alexey Shvayka <ashvayka> | ||||||||||
| Component: | JavaScriptCore | Assignee: | Alexey Shvayka <ashvayka> | ||||||||||
| Status: | RESOLVED FIXED | ||||||||||||
| Severity: | Trivial | CC: | ews-watchlist, keith_miller, mark.lam, msaboff, nisl_grammarly1, ross.kirsling, saam, tzagallo, webkit-bug-importer | ||||||||||
| Priority: | P2 | Keywords: | InRadar | ||||||||||
| Version: | WebKit Nightly Build | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | All | ||||||||||||
| Attachments: |
|
||||||||||||
Created attachment 395945 [details]
Patch
Created attachment 395952 [details]
Patch
Add spec link to ChangeLog.
Created attachment 395956 [details]
Patch
Rebase patch.
Comment on attachment 395956 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395956&action=review r=me with comment > Source/JavaScriptCore/ChangeLog:12 > + Also replaces 2 recently added throwTypeError() calls with throwVMTypeError(), > + as the latter seems to be preferred in ProxyObject. Seems like we should go the other way if we're not using the result, since throwVMTypeError just encodes the JSValue. Created attachment 395990 [details]
Patch
Set reviewer and replace throwVMTypeError() with unused results.
Committed r259822: <https://trac.webkit.org/changeset/259822> All reviewed patches have been landed. Closing bug and clearing flags on attachment 395990 [details]. *** Bug 217051 has been marked as a duplicate of this bug. *** |
Test case: Object.defineProperty(new Proxy({}, {defineProperty: () => false}), "foo", {}) Expected: TypeError thrown Actual: Proxy object returned ECMA262: https://tc39.es/ecma262/#sec-object.defineproperty (step 4) Test262: https://test262.report/browse/built-ins/Proxy/defineProperty/trap-is-undefined-target-is-proxy.js