Bug 142382 – __proto__ shorthand property should not modify prototype in Object Literal construction

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Joseph Pecoraro]

* SUMMARY
__proto__ shorthand property should not modify prototype in Object Literal construction.

<https://kangax.github.io/compat-table/es6/> has a section that __proto__ should not be supported as a shorthand, citing:
"Annex b § __proto__ in object literals".

{__proto__} should not be equivalent to {__proto__:...}.

Seems to be because:

  PropertyDefinition : IdentifierReference
  ...
  7. Return CreateDataPropertyOrThrow(object, propName, propValue).

And that does not fall under the Annex's special case handling of __proto__ in literals for grammar rule:

  PropertyDefinition : PropertyName : AssignmentExpression

So we shouldn't get the special handling.

--

Seems the expected behavior of __proto__ as a shorthand would be the equivalent of a Object.defineProperty(obj, "__proto__", { value: ... }) which sets the property but doesn't change the prototype.

[Joseph Pecoraro]

Created attachment 248045 [details]
[PATCH] Proposed Fix

[Geoffrey Garen]

Comment on attachment 248045 [details]
[PATCH] Proposed Fix

View in context: https://bugs.webkit.org/attachment.cgi?id=248045&action=review

r=me

> Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:379
> +        generator.emitDirectPutById(newObj, *node.name(), generator.emitNode(node.m_assign), node.putType() == PropertyNode::KnownDirect);

I think it would be slightly clearer to pass through the put type instead of a bool.

[Joseph Pecoraro]

This landed a while ago: r181179
<http://trac.webkit.org/changeset/181179>