Bug 155904 – ES6's throwing of TypeErrors on access of RegExp.prototype flag properties breaks websites

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Lam]

There exists a JS library XRegExp (see http://xregexp.com) that extends the regexp implementation.  XRegExp does feature testing by comparing RegExp.prototype.sticky to undefined.  See:

Example 1. https://github.com/slevithan/xregexp/blob/28a2b033c5951477bed8c7c867ddf7e89c431cd4/tests/perf/index.html
    …
    } else if (knownVersion[version]) {
        // Hack around ES6 incompatibility in XRegExp versions prior to 3.0.0
        if (parseInt(version, 10) < 3) {
            delete RegExp.prototype.sticky;
    }
    …

Example 2. https://github.com/slevithan/xregexp/blob/d0e665d4068cec4d15919215b098b2373f1f12e9/tests/perf/versions/xregexp-all-v2.0.0.js

    …
    // Check for flag y support (Firefox 3+)
        hasNativeY = RegExp.prototype.sticky !== undef,
    …

The ES6 spec states that we should throw a TypeError here because RegExp.prototype is not a RegExp object, and the sticky getter is only allowed to be called on RegExp objects.  See https://tc39.github.io/ecma262/2016/#sec-get-regexp.prototype.sticky.  As a result, websites that uses XRegExp can break (e.g. some Atlassian tools).

As a workaround, we'll return undefined instead of throwing on access of these flag properties that may be used for feature testing.

[Mark Lam]

<rdar://problem/25352879>

[Mark Lam]

Created attachment 274943 [details]
proposed patch.

Still need to do some due dilligence testing.

[Geoffrey Garen]

Comment on attachment 274943 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=274943&action=review

r=me

> Source/JavaScriptCore/ChangeLog:13
> +            â¦

ChangeLog should be ASCII.

> Source/JavaScriptCore/ChangeLog:19
> +            â¦

ChangeLog should be ASCII.

> Source/JavaScriptCore/ChangeLog:22
> +            â¦

ChangeLog should be ASCII.

> Source/JavaScriptCore/ChangeLog:25
> +            â¦

ChangeLog should be ASCII.

[Build Bot]

Comment on attachment 274943 [details]
proposed patch.

Attachment 274943 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/1039016

New failing tests:
js/pic/cached-named-property-getter.html
ietestcenter/Javascript/15.10.7.3-1.html
ietestcenter/Javascript/15.10.7.2-1.html
ietestcenter/Javascript/15.10.7.4-1.html

[Build Bot]

Created attachment 274947 [details]
Archive of layout-test-results from ews103 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews103  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Build Bot]

Comment on attachment 274943 [details]
proposed patch.

Attachment 274943 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/1039041

New failing tests:
js/pic/cached-named-property-getter.html
ietestcenter/Javascript/15.10.7.3-1.html
ietestcenter/Javascript/15.10.7.2-1.html
ietestcenter/Javascript/15.10.7.4-1.html

[Build Bot]

Created attachment 274950 [details]
Archive of layout-test-results from ews107 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5

[Mark Lam]

Created attachment 274951 [details]
patch for landing.

FYI, Geoff approved the test fixes offline.

[Mark Lam]

I don't think the failing tests in the EWS are due to this patch.

Landed in r198698: <http://trac.webkit.org/r198698>.

[Michael Saboff]

Chrome has data from anonymous opt-in usage data for RegExp.prototype.stick at https://www.chromestatus.com/metrics/feature/popularity#V8RegExpPrototypeStickyGetter.  It reports that 0.053% of sites perform these accesses.  This was with Chrome 49.  All of these accesses are expected to be caused by XRegExp.