Bug 199744 – A Possible Issue of Object.create method

• Component: JavaScriptCore
• Status: RESOLVED FIXED

#Testcase:
var foo = function () {
                var newObj = Object.create({}, 2);
                print(newObj);
};
foo();

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
Exception: TypeError: Property descriptor list must be an Object.
create@[native code]
[e-mail]:2:29
global [e-mail]:5:4

#Expected output:
[object Object]

#Description:
According to ECMAScript-262, when the first parameter "O" of Object.create (O, Properties) is correct while the second parameter "Properties" is incorrect (shown as line 2 in the above testcase), the JS engine should ignore the illegal parameter and successfully create the object. However, when running the above testcase, javascriptCore throws a TypeError exception while other JS engines such as SpiderMonkey, V8 and chakra output "[object Object]". Is it a compatibility issue of javascriptCore or an extension of ECMAScript?

[Radar WebKit Bug Importer]

<rdar://problem/53034203>

[Keith Miller]

Created attachment 374058 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 374058 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=374058&action=review

r=me with nit.

> Source/JavaScriptCore/runtime/ObjectConstructor.cpp:672
> +    JSObject* properties = exec->argument(1).toObject(exec);

Let's use `uncheckedArgument` here.

[Devin Rousso]

Comment on attachment 374058 [details]
Patch

r=me

[Keith Miller]

Created attachment 374060 [details]
Patch for landing

[Keith Miller]

Comment on attachment 374058 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=374058&action=review

>> Source/JavaScriptCore/runtime/ObjectConstructor.cpp:672
>> +    JSObject* properties = exec->argument(1).toObject(exec);
> 
> Let's use `uncheckedArgument` here.

done.

[WebKit Commit Bot]

Comment on attachment 374060 [details]
Patch for landing

Rejecting attachment 374060 [details] from commit-queue.

New failing tests:
js/Object-create.html
Full output: https://webkit-queues.webkit.org/results/12729620

[WebKit Commit Bot]

Created attachment 374069 [details]
Archive of layout-test-results from webkit-cq-01 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the commit-queue.
Bot: webkit-cq-01  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[Keith Miller]

Created attachment 374126 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 374126 [details]
Patch for landing

Rejecting attachment 374126 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-01', 'validate-changelog', '--check-oops', '--non-interactive', 374126, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: https://webkit-queues.webkit.org/results/12743838

[Keith Miller]

Created attachment 374129 [details]
Patch for landing

[Keith Miller]

Created attachment 374130 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 374130 [details]
Patch for landing

Rejecting attachment 374130 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-03', 'validate-changelog', '--check-oops', '--non-interactive', 374130, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: https://webkit-queues.webkit.org/results/12744038

[Keith Miller]

Created attachment 374135 [details]
Patch for landing

[Keith Miller]

Created attachment 374136 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 374136 [details]
Patch for landing

Clearing flags on attachment: 374136

Committed r247471: <https://trac.webkit.org/changeset/247471>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.