DateProtoFuncImp::callAsFunction will call internalValue->toNumber on most inputs, w/o checking the type. This can a) crash (see below) b) seems wrong since I do not see it in the spec that most methods of Date.prototype should be generic. Sample testcase: Math.__proto__.crash = Date.prototype.getDate; Math.crash(); (spotted when trying to push internalValue further down into hierarchy)
<rdar://problem/4406070>
Created attachment 5650 [details] reduction Attached reduction.
15.9.5 Properties of the Date Prototype Object None of these functions are generic; a TypeError exception is thrown if the this value is not an object for which the value of the internal [[Class]] property is "Date".
Created attachment 5651 [details] Fix Three cheers for the delete key. 0 regressions found. 0 tests fixed.
Comment on attachment 5651 [details] Fix Would be nice to test all the methods instead of just getDate. r=me
Landed with tests for all methods but valueOf, which seems to confuse our test engine. Will file new bug about that.