Extending null should set __proto__ to null

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Ryosuke Niwa]

new (class A extends null {}).__proto__ should evalute to null according to the spec.
Function.prototype.isPrototypeOf(A) should still be true.

[Ryosuke Niwa]

@@ -2899,6 +2903,9 @@ RegisterID* ClassExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID
     prototype = generator.emitGetById(generator.newTemporary(), constructor.get(), generator.propertyNames().prototype);
 
     if (superclass) {
+        RefPtr<RegisterID> protoParent = generator.newTemporary();
+        generator.emitLoad(protoParent.get(), jsNull());
+
         RefPtr<RegisterID> tempRegister = generator.newTemporary();
         RefPtr<Label> superclassIsNullLabel = generator.newLabel();
         generator.emitJumpIfTrue(generator.emitUnaryOp(op_eq_null, tempRegister.get(), superclass.get()), superclassIsNullLabel.get());
@@ -2908,8 +2915,6 @@ RegisterID* ClassExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID
         generator.emitJumpIfTrue(generator.emitIsObject(tempRegister.get(), superclass.get()), superclassIsObjectLabel.get());
         generator.emitThrowTypeError(ASCIILiteral("The superclass is not an object."));
         generator.emitLabel(superclassIsObjectLabel.get());
-
-        RefPtr<RegisterID> protoParent = generator.newTemporary();
         generator.emitGetById(protoParent.get(), superclass.get(), generator.propertyNames().prototype);
 
         RefPtr<Label> protoParentIsObjectOrNullLabel = generator.newLabel();
@@ -2918,9 +2923,9 @@ RegisterID* ClassExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID
         generator.emitLabel(protoParentIsObjectOrNullLabel.get());
 
         generator.emitDirectPutById(constructor.get(), generator.propertyNames().underscoreProto, superclass.get(), PropertyNode::Unknown);
+        generator.emitLabel(superclassIsNullLabel.get());
         generator.emitDirectPutById(prototype.get(), generator.propertyNames().underscoreProto, protoParent.get(), PropertyNode::Unknown);
 
-        generator.emitLabel(superclassIsNullLabel.get());
         emitPutHomeObject(generator, constructor.get(), prototype.get());
     }

[Ryosuke Niwa]

Created attachment 249644 [details]
Fixes the bug

[Build Bot]

Comment on attachment 249644 [details]
Fixes the bug

Attachment 249644 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/5684121242173440

New failing tests:
js/class-syntax-super.html
js/class-syntax-call.html

[Build Bot]

Created attachment 249645 [details]
Archive of layout-test-results from ews105 for mac-mavericks-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-mavericks-wk2  Platform: Mac OS X 10.9.5

[Build Bot]

Comment on attachment 249644 [details]
Fixes the bug

Attachment 249644 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/5383994296238080

New failing tests:
js/class-syntax-super.html
js/class-syntax-call.html

[Build Bot]

Created attachment 249647 [details]
Archive of layout-test-results from ews100 for mac-mavericks

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews100  Port: mac-mavericks  Platform: Mac OS X 10.9.5

[Ryosuke Niwa]

Created attachment 249656 [details]
Fixes the bug

[Geoffrey Garen]

Comment on attachment 249656 [details]
Fixes the bug

r=me

[Benjamin Poulain]

View in context: https://bugs.webkit.org/attachment.cgi?id=249656&action=review

> LayoutTests/js/script-tests/class-syntax-extends.js:72
> +shouldBe('Object.getPrototypeOf((class extends null { constructor () { super(); } }).prototype)', 'null');

You should also have coverage for extending undefined.

> LayoutTests/js/script-tests/class-syntax-extends.js:74
> +shouldThrow('new (class extends null { constructor () { super(); } })', '"TypeError: undefined is not an object (evaluating \'super()\')"');

+ add a test case where the constructor return a new, completely different, object.

[Ryosuke Niwa]

Committed r182171: <http://trac.webkit.org/changeset/182171>