Bug 198976

Summary:

Promise constructor should check argument before [[Construct]]

Product:

WebKit

Reporter:

Alexey Shvayka <ashvayka>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Minor

CC:

commit-queue, ews-watchlist, guijemont, guijemont+jsc-armv7-ews, joepeck, keith_miller, mark.lam, msaboff, ross.kirsling, saam, tzagallo, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

All

OS:

All

Attachments:

Description	Flags
Patch	none
Patch	none
Patch	none

Alexey Shvayka

Reported 2019-06-18 13:47:05 PDT

Because "prototype" lookup is observable.

Attachments
Patch (4.21 KB, patch) 2019-06-18 13:52 PDT, Alexey Shvayka	no flags	Details Formatted Diff Diff
Patch (4.14 KB, patch) 2019-06-18 16:12 PDT, Alexey Shvayka	no flags	Details Formatted Diff Diff
Patch (5.84 KB, patch) 2019-06-19 01:19 PDT, Alexey Shvayka	no flags	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.

Alexey Shvayka

Comment 1 2019-06-18 13:52:31 PDT

Created attachment 372377 [details] Patch

Alexey Shvayka

Comment 2 2019-06-18 16:12:37 PDT

Created attachment 372401 [details] Patch

EWS Watchlist

Comment 3 2019-06-18 18:17:55 PDT

Comment on attachment 372401 [details] Patch Attachment 372401 [details] did not pass jsc-ews (mac): Output: https://webkit-queues.webkit.org/results/12514283 New failing tests: stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-llint stress/create-subclass-structure-might-throw.js.ftl-no-cjit-b3o0 stress/create-subclass-structure-might-throw.js.ftl-no-cjit-small-pool stress/create-subclass-structure-might-throw.js.no-ftl stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-no-put-stack-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-no-inline-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-b3o0 stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.mini-mode stress/create-subclass-structure-might-throw.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-llint stress/create-subclass-structure-might-throw.js.ftl-eager-no-cjit stress/create-subclass-structure-might-throw.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-small-pool stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.default stress/create-subclass-structure-might-throw.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-might-throw.js.default stress/create-subclass-structure-might-throw.js.bytecode-cache stress/create-subclass-structure-might-throw.js.ftl-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.bytecode-cache stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-ftl stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.ftl-eager-no-cjit-b3o1 stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager-no-cjit-b3o1 stress/create-subclass-structure-might-throw.js.ftl-no-cjit-no-inline-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager stress/create-subclass-structure-might-throw.js.mini-mode stress/create-subclass-structure-might-throw.js.ftl-no-cjit-validate-sampling-profiler stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-validate-sampling-profiler stress/create-subclass-structure-might-throw.js.ftl-no-cjit-no-put-stack-validate apiTests

jsc-armv7 EWS

Comment 4 2019-06-18 20:24:26 PDT

Comment on attachment 372401 [details] Patch Attachment 372401 [details] did not pass jsc-armv7-ews (jsc-only): Output: https://webkit-queues.webkit.org/results/12515198 New failing tests: stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-llint stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.mini-mode stress/create-subclass-structure-might-throw.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.no-llint stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-might-throw.js.mini-mode stress/create-subclass-structure-might-throw.js.no-cjit-collect-continuously stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.default stress/create-subclass-structure-might-throw.js.default stress/create-subclass-structure-might-throw.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.dfg-maximal-flush-validate-no-cjit apiTests

Alexey Shvayka

Comment 5 2019-06-19 01:19:28 PDT

Created attachment 372443 [details] Patch Adjust tests.

Ross Kirsling

Comment 6 2019-08-16 12:57:49 PDT

Comment on attachment 372443 [details] Patch Nice! You seem to be really good at finding this "slightly-off" cases. :D

WebKit Commit Bot

Comment 7 2019-08-16 13:09:44 PDT

Comment on attachment 372443 [details] Patch Clearing flags on attachment: 372443 Committed r248787: <https://trac.webkit.org/changeset/248787>

WebKit Commit Bot

Comment 8 2019-08-16 13:09:46 PDT

All reviewed patches have been landed. Closing bug.

Radar WebKit Bug Importer

Comment 9 2019-08-16 13:10:18 PDT

<rdar://problem/54404112>

Note You need to log in before you can comment on or make changes to this bug.