newlog.txt

------------------------------------------------------------------------
r209424 | mark.lam@apple.com | 2016-12-06 22:43:16 +0000 (Tue, 06 Dec 2016) | 107 lines
Changed paths:
   M /trunk/JSTests/ChangeLog
   M /trunk/JSTests/stress/get-from-scope-dynamic-onto-proxy.js
   D /trunk/JSTests/stress/proxy-dont-infinite-loop.js
   D /trunk/JSTests/stress/proxy-json-path.js
   D /trunk/JSTests/stress/rest-parameter-allocation-elimination-watchpoints-6.js
   M /trunk/LayoutTests/ChangeLog
   M /trunk/LayoutTests/TestExpectations
   M /trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt
   M /trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt
   M /trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain.html
   A /trunk/LayoutTests/js/prototype-assignment-expected.txt
   A /trunk/LayoutTests/js/prototype-assignment.html
   A /trunk/LayoutTests/js/script-tests/prototype-assignment.js
   M /trunk/LayoutTests/js/setPrototypeOf-expected.txt
   M /trunk/Source/JavaScriptCore/ChangeLog
   M /trunk/Source/JavaScriptCore/runtime/JSObject.cpp
   M /trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h
   M /trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
   M /trunk/Source/JavaScriptCore/runtime/ObjectPrototype.h
   M /trunk/Source/JavaScriptCore/runtime/Structure.h
   M /trunk/Source/WebCore/ChangeLog
   M /trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h
   M /trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
   M /trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt
   M /trunk/Source/WebCore/dom/EventTarget.idl
   M /trunk/Source/WebCore/page/DOMWindow.idl

Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
https://bugs.webkit.org/show_bug.cgi?id=165227
<rdar://problem/29442665>

Reviewed by Saam Barati.

JSTests:

* stress/get-from-scope-dynamic-onto-proxy.js:
- Updated error message.

* stress/proxy-dont-infinite-loop.js: Removed.
* stress/proxy-json-path.js: Removed.
* stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
- Removed these tests because the issue they are testing relies on being able to
  set Object.prototype.__proto__ to something else (which is now not possible).

Source/JavaScriptCore:

* runtime/JSObject.cpp:
(JSC::JSObject::setPrototypeWithCycleCheck):
- This is where we check for immutable prototype exotic objects and refuse to set
  the prototype if needed.
  See https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.

* runtime/JSTypeInfo.h:
(JSC::TypeInfo::isImmutablePrototypeExoticObject):
* runtime/Structure.h:
- Add flag for declaring immutable prototype exotic objects.

* runtime/ObjectPrototype.h:
- Declare that Object.prototype is an immutable prototype exotic object.
  See https://tc39.github.io/ecma262/#sec-properties-of-the-object-prototype-object.

* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSetPrototypeOf):
- Use better error messages.

Source/WebCore:

Make all objects in window.__proto__'s prototype chain immutable prototype exotic
objects.  This gives us roughly equivalent behavior to other browsers.  

Firefox's behavior differ slightly in that Firefox will fail any attempted
assignment their __proto__, while the immutable prototype exotic objects will
only fail if the assignment is of a different value.  See
https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.

Chrome differs in that assignment to window.__proto__ is also handled like an
immutable prototype exotic object.  Instead we adhere to the current HTML spec
that says that the assignment should fail unconditionally.  See
https://html.spec.whatwg.org/#the-windowproxy-exotic-object and
https://html.spec.whatwg.org/#windowproxy-setprototypeof.

If the HTML spec is changed to make the WindowProxy and Location objects into
immutable prototype exotic objects later, we can update to match the spec then.

Test: js/prototype-assignment.html

* bindings/js/JSDOMWindowProperties.h:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GeneratePrototypeDeclaration):
* bindings/scripts/IDLAttributes.txt:
* dom/EventTarget.idl:
* page/DOMWindow.idl:

LayoutTests:

The new prototype-assignment.js test is currently only enabled for LLInt only
run in the JSC tests until webkit.org/b/165401 is fixed.

* TestExpectations:
- Skip js/prototype-assignment.html for now until webkit.org/b/165401 is fixed.

* http/tests/security/window-named-valueOf-expected.txt:
* js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt:
* js/dom/proxy-is-not-allowed-in-global-prototype-chain.html:
- Updated error messages.

* js/prototype-assignment-expected.txt: Added.
* js/prototype-assignment.html: Added.
* js/script-tests/prototype-assignment.js: Added.
(else):
(reportError):
(shouldEqual):
(shouldThrow):
(stringify):
(makeTestID):
(doInternalSetPrototypeOf):
(ordinarySetPrototypeOf):
(setImmutablePrototype):
(windowProxySetPrototypeOf):
(initSetterExpectation):
(throwIfNoExceptionPending):
(objectSetPrototypeOf):
(setUnderscoreProto):
(reflectSetPrototypeOf):
(newObjectProto.toString):
(this.testObject.targets.push.value):
(this.testProxy.targets.push.setPrototypeOf):
(Symbol):
(test):
(runTests):
* js/setPrototypeOf-expected.txt:


------------------------------------------------------------------------
------------------------------------------------------------------------
r209149 | mark.lam@apple.com | 2016-11-30 21:13:42 +0000 (Wed, 30 Nov 2016) | 17 lines
Changed paths:
   M /trunk/LayoutTests/ChangeLog
   A /trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt
   A /trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain.html
   M /trunk/Source/JavaScriptCore/ChangeLog
   M /trunk/Source/JavaScriptCore/runtime/ProgramExecutable.cpp

Proxy is not allowed in the global prototype chain.
https://bugs.webkit.org/show_bug.cgi?id=165205

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

* runtime/ProgramExecutable.cpp:
(JSC::ProgramExecutable::initializeGlobalProperties):
- We'll now throw a TypeError if we detect a Proxy in the global prototype chain.

LayoutTests:

* js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt: Added.
* js/dom/proxy-is-not-allowed-in-global-prototype-chain.html: Added.


------------------------------------------------------------------------