Bug 199744 - A Possible Issue of Object.create method
Summary: A Possible Issue of Object.create method
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Local Build
Hardware: PC Linux
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-07-11 20:22 PDT by yaohouyou
Modified: 2019-07-15 21:26 PDT (History)
11 users (show)

See Also:


Attachments
Patch (3.10 KB, patch)
2019-07-12 17:59 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch for landing (3.11 KB, patch)
2019-07-12 18:06 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from webkit-cq-01 for mac-highsierra (3.18 MB, application/zip)
2019-07-12 19:14 PDT, WebKit Commit Bot
no flags Details
Patch for landing (5.23 KB, patch)
2019-07-15 11:25 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch for landing (5.30 KB, patch)
2019-07-15 11:35 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch for landing (5.28 KB, patch)
2019-07-15 11:37 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch for landing (5.38 KB, patch)
2019-07-15 12:25 PDT, Keith Miller
no flags Details | Formatted Diff | Diff
Patch for landing (5.38 KB, patch)
2019-07-15 12:31 PDT, Keith Miller
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description yaohouyou 2019-07-11 20:22:39 PDT
#Testcase:
var foo = function () {
                var newObj = Object.create({}, 2);
                print(newObj);
};
foo();

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
Exception: TypeError: Property descriptor list must be an Object.
create@[native code]
foo@testcase.js:2:29
global code@testcase.js:5:4

#Expected output:
[object Object]

#Description:
According to ECMAScript-262, when the first parameter "O" of Object.create (O, Properties) is correct while the second parameter "Properties" is incorrect (shown as line 2 in the above testcase), the JS engine should ignore the illegal parameter and successfully create the object. However, when running the above testcase, javascriptCore throws a TypeError exception while other JS engines such as SpiderMonkey, V8 and chakra output "[object Object]". Is it a compatibility issue of javascriptCore or an extension of ECMAScript?
Comment 1 Radar WebKit Bug Importer 2019-07-12 16:59:26 PDT
<rdar://problem/53034203>
Comment 2 Keith Miller 2019-07-12 17:59:49 PDT
Created attachment 374058 [details]
Patch
Comment 3 Yusuke Suzuki 2019-07-12 18:02:58 PDT
Comment on attachment 374058 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=374058&action=review

r=me with nit.

> Source/JavaScriptCore/runtime/ObjectConstructor.cpp:672
> +    JSObject* properties = exec->argument(1).toObject(exec);

Let's use `uncheckedArgument` here.
Comment 4 Devin Rousso 2019-07-12 18:03:11 PDT
Comment on attachment 374058 [details]
Patch

r=me
Comment 5 Keith Miller 2019-07-12 18:06:48 PDT
Created attachment 374060 [details]
Patch for landing
Comment 6 Keith Miller 2019-07-12 18:07:01 PDT
Comment on attachment 374058 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=374058&action=review

>> Source/JavaScriptCore/runtime/ObjectConstructor.cpp:672
>> +    JSObject* properties = exec->argument(1).toObject(exec);
> 
> Let's use `uncheckedArgument` here.

done.
Comment 7 WebKit Commit Bot 2019-07-12 19:14:03 PDT
Comment on attachment 374060 [details]
Patch for landing

Rejecting attachment 374060 [details] from commit-queue.

New failing tests:
js/Object-create.html
Full output: https://webkit-queues.webkit.org/results/12729620
Comment 8 WebKit Commit Bot 2019-07-12 19:14:05 PDT
Created attachment 374069 [details]
Archive of layout-test-results from webkit-cq-01 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the commit-queue.
Bot: webkit-cq-01  Port: mac-highsierra  Platform: Mac OS X 10.13.6
Comment 9 Keith Miller 2019-07-15 11:25:41 PDT
Created attachment 374126 [details]
Patch for landing
Comment 10 WebKit Commit Bot 2019-07-15 11:27:41 PDT
Comment on attachment 374126 [details]
Patch for landing

Rejecting attachment 374126 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-01', 'validate-changelog', '--check-oops', '--non-interactive', 374126, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: https://webkit-queues.webkit.org/results/12743838
Comment 11 Keith Miller 2019-07-15 11:35:04 PDT
Created attachment 374129 [details]
Patch for landing
Comment 12 Keith Miller 2019-07-15 11:37:14 PDT
Created attachment 374130 [details]
Patch for landing
Comment 13 WebKit Commit Bot 2019-07-15 12:01:10 PDT
Comment on attachment 374130 [details]
Patch for landing

Rejecting attachment 374130 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-03', 'validate-changelog', '--check-oops', '--non-interactive', 374130, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit

ChangeLog entry in LayoutTests/ChangeLog contains OOPS!.

Full output: https://webkit-queues.webkit.org/results/12744038
Comment 14 Keith Miller 2019-07-15 12:25:59 PDT
Created attachment 374135 [details]
Patch for landing
Comment 15 Keith Miller 2019-07-15 12:31:59 PDT
Created attachment 374136 [details]
Patch for landing
Comment 16 WebKit Commit Bot 2019-07-15 21:26:11 PDT
Comment on attachment 374136 [details]
Patch for landing

Clearing flags on attachment: 374136

Committed r247471: <https://trac.webkit.org/changeset/247471>
Comment 17 WebKit Commit Bot 2019-07-15 21:26:13 PDT
All reviewed patches have been landed.  Closing bug.