Bug 155904 - ES6's throwing of TypeErrors on access of RegExp.prototype flag properties breaks websites
Summary: ES6's throwing of TypeErrors on access of RegExp.prototype flag properties br...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2016-03-25 14:52 PDT by Mark Lam
Modified: 2016-03-28 17:03 PDT (History)
9 users (show)

See Also:


Attachments
proposed patch. (4.20 KB, patch)
2016-03-25 15:01 PDT, Mark Lam
ggaren: review+
buildbot: commit-queue-
Details | Formatted Diff | Diff
Archive of layout-test-results from ews103 for mac-yosemite (1.00 MB, application/zip)
2016-03-25 15:35 PDT, Build Bot
no flags Details
Archive of layout-test-results from ews107 for mac-yosemite-wk2 (788.24 KB, application/zip)
2016-03-25 15:47 PDT, Build Bot
no flags Details
patch for landing. (7.94 KB, patch)
2016-03-25 15:51 PDT, Mark Lam
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2016-03-25 14:52:43 PDT
There exists a JS library XRegExp (see http://xregexp.com) that extends the regexp implementation.  XRegExp does feature testing by comparing RegExp.prototype.sticky to undefined.  See:

Example 1. https://github.com/slevithan/xregexp/blob/28a2b033c5951477bed8c7c867ddf7e89c431cd4/tests/perf/index.html
    …
    } else if (knownVersion[version]) {
        // Hack around ES6 incompatibility in XRegExp versions prior to 3.0.0
        if (parseInt(version, 10) < 3) {
            delete RegExp.prototype.sticky;
    }
    …

Example 2. https://github.com/slevithan/xregexp/blob/d0e665d4068cec4d15919215b098b2373f1f12e9/tests/perf/versions/xregexp-all-v2.0.0.js

    …
    // Check for flag y support (Firefox 3+)
        hasNativeY = RegExp.prototype.sticky !== undef,
    …

The ES6 spec states that we should throw a TypeError here because RegExp.prototype is not a RegExp object, and the sticky getter is only allowed to be called on RegExp objects.  See https://tc39.github.io/ecma262/2016/#sec-get-regexp.prototype.sticky.  As a result, websites that uses XRegExp can break (e.g. some Atlassian tools).

As a workaround, we'll return undefined instead of throwing on access of these flag properties that may be used for feature testing.
Comment 1 Mark Lam 2016-03-25 14:53:26 PDT
<rdar://problem/25352879>
Comment 2 Mark Lam 2016-03-25 15:01:29 PDT
Created attachment 274943 [details]
proposed patch.

Still need to do some due dilligence testing.
Comment 3 Geoffrey Garen 2016-03-25 15:06:02 PDT
Comment on attachment 274943 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=274943&action=review

r=me

> Source/JavaScriptCore/ChangeLog:13
> +            â¦

ChangeLog should be ASCII.

> Source/JavaScriptCore/ChangeLog:19
> +            â¦

ChangeLog should be ASCII.

> Source/JavaScriptCore/ChangeLog:22
> +            â¦

ChangeLog should be ASCII.

> Source/JavaScriptCore/ChangeLog:25
> +            â¦

ChangeLog should be ASCII.
Comment 4 Build Bot 2016-03-25 15:35:37 PDT
Comment on attachment 274943 [details]
proposed patch.

Attachment 274943 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/1039016

New failing tests:
js/pic/cached-named-property-getter.html
ietestcenter/Javascript/15.10.7.3-1.html
ietestcenter/Javascript/15.10.7.2-1.html
ietestcenter/Javascript/15.10.7.4-1.html
Comment 5 Build Bot 2016-03-25 15:35:40 PDT
Created attachment 274947 [details]
Archive of layout-test-results from ews103 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews103  Port: mac-yosemite  Platform: Mac OS X 10.10.5
Comment 6 Build Bot 2016-03-25 15:47:33 PDT
Comment on attachment 274943 [details]
proposed patch.

Attachment 274943 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/1039041

New failing tests:
js/pic/cached-named-property-getter.html
ietestcenter/Javascript/15.10.7.3-1.html
ietestcenter/Javascript/15.10.7.2-1.html
ietestcenter/Javascript/15.10.7.4-1.html
Comment 7 Build Bot 2016-03-25 15:47:37 PDT
Created attachment 274950 [details]
Archive of layout-test-results from ews107 for mac-yosemite-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-yosemite-wk2  Platform: Mac OS X 10.10.5
Comment 8 Mark Lam 2016-03-25 15:51:04 PDT
Created attachment 274951 [details]
patch for landing.

FYI, Geoff approved the test fixes offline.
Comment 9 Mark Lam 2016-03-25 16:26:12 PDT
I don't think the failing tests in the EWS are due to this patch.

Landed in r198698: <http://trac.webkit.org/r198698>.
Comment 10 Michael Saboff 2016-03-28 17:03:07 PDT
Chrome has data from anonymous opt-in usage data for RegExp.prototype.stick at https://www.chromestatus.com/metrics/feature/popularity#V8RegExpPrototypeStickyGetter.  It reports that 0.053% of sites perform these accesses.  This was with Chrome 49.  All of these accesses are expected to be caused by XRegExp.