RegExp.prototype getters should throw on cross-realm access
Created attachment 401644 [details] Patch
Comment on attachment 401644 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=401644&action=review > Source/JavaScriptCore/runtime/RegExpPrototype.cpp:242 > + if (thisValue == globalObject->regExpPrototype()) Which realm is used by the spec? The realm from the object? Or the realm of the static code running? This is using the latter. Is that intentional?
(In reply to Saam Barati from comment #2) > Comment on attachment 401644 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=401644&action=review > > > Source/JavaScriptCore/runtime/RegExpPrototype.cpp:242 > > + if (thisValue == globalObject->regExpPrototype()) > > Which realm is used by the spec? The realm from the object? Or the realm of > the static code running? This is using the latter. Is that intentional? The spec uses realm of static code (of a getter). Otherwise, the check would never fail: if `object` is a %RegExp.prototype%, `object.realm.RegExp.prototype` is `object` itself.
Committed r262908: <https://trac.webkit.org/changeset/262908> All reviewed patches have been landed. Closing bug and clearing flags on attachment 401644 [details].
<rdar://problem/64259571>