Bug 49606

Summary: instanceof should only get the prototype property if the RHS operand implements HasInstance
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
the patch oliver: review+

Gavin Barraclough
Reported 2010-11-16 11:14:09 PST
test case: javascript: ({} instanceof { get prototype(){ alert("Error!"); } }) The bug here is that we read the prototype from the RHS argument using a regular op_get_by_id before op_instanceof has checked that this is an object implementing HasInstance. This incorrect behaviour gives rise to further unnecessary complexity in the code base, since we have additional logic (implemented using the GetByIdExceptionInfo data structures on CodeBlock) to convert not an object errors from the get_by_id into invalid parameter errors. Having fixed this bug this code is all redundant, since in these cases the get_by_id will never have been reached. (op_construct had a similar error, but this is fixed since we moved this object creation to inside the constructor function.)
Attachments
the patch (47.75 KB, patch)
2010-11-16 12:18 PST, Gavin Barraclough 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2010-11-16 12:18:17 PST
Created attachment 74020 [details] the patch
Gavin Barraclough
Comment 2 2010-11-16 13:12:02 PST
fixed in r72127
Note You need to log in before you can comment on or make changes to this bug.