Bug 215769 – __proto__ in object literal should perform [[SetPrototypeOf]] directly

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Alexey Shvayka]

Test case: `delete Object.prototype.__proto__; Object.getPrototypeOf({__proto__: null})`
Expected: `null`
Actual: `Object.prototype`

ECMA-262: https://tc39.es/ecma262/#sec-__proto__-property-names-in-object-initializers (step 7.a.i)

[Alexey Shvayka]

Created attachment 407244 [details]
Patch

[Alexey Shvayka]

(In reply to Alexey Shvayka from comment #1)
> Created attachment 407244 [details]
> Patch

Warmed-up runs, --outer 50:

                                                 r265669                    patch

object-literal-underscore-proto-setter       96.5690+-0.8588     ^     77.5015+-0.3901        ^ definitely 1.2460x faster

[Ross Kirsling]

Comment on attachment 407244 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=407244&action=review

Seems good overall, but is there a test262 case?

> Source/JavaScriptCore/ChangeLog:19
> +        Tweaks globalFuncSetPrototypeDirect() to ignore a prototype value of incorrect type,
> +        which is unobservable for its usages in ClassExprNode::emitBytecode(). Also, removes unused

Does this tweak help with an existing case or is it just removing a restriction that no longer matters?

> Source/JavaScriptCore/parser/Nodes.h:769
> -    class PropertyListNode final : public ExpressionNode {
> +    class PropertyListNode final : public ExpressionNode, public ThrowableExpressionData {

Is this demanded by the emitPutConstantProperty change somehow?

[Alexey Shvayka]

(In reply to Ross Kirsling from comment #3)
> Seems good overall, but is there a test262 case?

Thank you for taking a look!
I am adding the test in https://github.com/tc39/test262/pull/2747, yet the patch is fully covered by LayoutTests/js/script-tests/object-literal-direct-put.js update (ToT fails it).

> Does this tweak help with an existing case or is it just removing a restriction that no longer matters?

It is necessary for this change, as it implements the type check at step 7.a of https://tc39.es/ecma262/#sec-__proto__-property-names-in-object-initializers.
I will make sure to clarify the ChangeLog, "tweak" is rather misleading.

> Is this demanded by the emitPutConstantProperty change somehow?

Yes, it is required to get divot*(), which is needed for OpCall in emitDirectSetPrototypeOf(), even though it never throws.

[Ross Kirsling]

Comment on attachment 407244 [details]
Patch

Cool, r=me given those points of clarification.

[Alexey Shvayka]

Created attachment 407365 [details]
Patch

Clarify ChangeLog, assert that globalFuncSetPrototypeDirect() doesn't throw, and don't extend ThrowableExpressionData.

[EWS]

Committed r266264: <https://trac.webkit.org/changeset/266264>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 407365 [details].

[Radar WebKit Bug Importer]

<rdar://problem/67907341>