RESOLVED FIXED198976
Promise constructor should check argument before [[Construct]] 
https://bugs.webkit.org/show_bug.cgi?id=198976
Summary Promise constructor should check argument before [[Construct]]
Alexey Shvayka
Reported 2019-06-18 13:47:05 PDT
Because "prototype" lookup is observable.
Attachments
Patch (4.21 KB, patch)
2019-06-18 13:52 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Patch (4.14 KB, patch)
2019-06-18 16:12 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Patch (5.84 KB, patch)
2019-06-19 01:19 PDT, Alexey Shvayka 		no flags
DetailsFormatted DiffDiff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Alexey Shvayka
Comment 1 2019-06-18 13:52:31 PDT
Created attachment 372377 [details] Patch
Alexey Shvayka
Comment 2 2019-06-18 16:12:37 PDT
Created attachment 372401 [details] Patch
EWS Watchlist
Comment 3 2019-06-18 18:17:55 PDT
Comment on attachment 372401 [details] Patch Attachment 372401 [details] did not pass jsc-ews (mac): Output: https://webkit-queues.webkit.org/results/12514283 New failing tests: stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-llint stress/create-subclass-structure-might-throw.js.ftl-no-cjit-b3o0 stress/create-subclass-structure-might-throw.js.ftl-no-cjit-small-pool stress/create-subclass-structure-might-throw.js.no-ftl stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-no-put-stack-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-no-inline-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-b3o0 stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.mini-mode stress/create-subclass-structure-might-throw.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-llint stress/create-subclass-structure-might-throw.js.ftl-eager-no-cjit stress/create-subclass-structure-might-throw.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-small-pool stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.default stress/create-subclass-structure-might-throw.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-might-throw.js.default stress/create-subclass-structure-might-throw.js.bytecode-cache stress/create-subclass-structure-might-throw.js.ftl-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.bytecode-cache stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-ftl stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.ftl-eager-no-cjit-b3o1 stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-eager-no-cjit-b3o1 stress/create-subclass-structure-might-throw.js.ftl-no-cjit-no-inline-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager stress/create-subclass-structure-might-throw.js.mini-mode stress/create-subclass-structure-might-throw.js.ftl-no-cjit-validate-sampling-profiler stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.ftl-no-cjit-validate-sampling-profiler stress/create-subclass-structure-might-throw.js.ftl-no-cjit-no-put-stack-validate apiTests
jsc-armv7 EWS
Comment 4 2019-06-18 20:24:26 PDT
Comment on attachment 372401 [details] Patch Attachment 372401 [details] did not pass jsc-armv7-ews (jsc-only): Output: https://webkit-queues.webkit.org/results/12515198 New failing tests: stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-llint stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.mini-mode stress/create-subclass-structure-might-throw.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-collect-continuously stress/create-subclass-structure-might-throw.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.no-llint stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-eager stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.dfg-maximal-flush-validate-no-cjit stress/create-subclass-structure-might-throw.js.mini-mode stress/create-subclass-structure-might-throw.js.no-cjit-collect-continuously stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.default stress/create-subclass-structure-might-throw.js.default stress/create-subclass-structure-might-throw.js.dfg-eager-no-cjit-validate stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js.no-cjit-validate-phases stress/create-subclass-structure-might-throw.js.dfg-maximal-flush-validate-no-cjit apiTests
Alexey Shvayka
Comment 5 2019-06-19 01:19:28 PDT
Created attachment 372443 [details] Patch Adjust tests.
Ross Kirsling
Comment 6 2019-08-16 12:57:49 PDT
Comment on attachment 372443 [details] Patch Nice! You seem to be really good at finding this "slightly-off" cases. :D
WebKit Commit Bot
Comment 7 2019-08-16 13:09:44 PDT
Comment on attachment 372443 [details] Patch Clearing flags on attachment: 372443 Committed r248787: <https://trac.webkit.org/changeset/248787>
WebKit Commit Bot
Comment 8 2019-08-16 13:09:46 PDT
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 9 2019-08-16 13:10:18 PDT
<rdar://problem/54404112>
Note You need to log in before you can comment on or make changes to this bug.