<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"

"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />

<title>[209424] trunk</title>

</head>

<body>

<style type="text/css"><!--

#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }

#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }

#msg dt:after { content:':';}

#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }

#msg dl a { font-weight: bold}

#msg dl a:link    { color:#fc3; }

#msg dl a:active  { color:#ff0; }

#msg dl a:visited { color:#cc6; }

h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }

#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }

#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }

#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }

#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }

#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }

#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }

#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }

#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }

#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }

#logmsg pre { background: #eee; padding: 1em; }

#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}

#logmsg dl { margin: 0; }

#logmsg dt { font-weight: bold; }

#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }

#logmsg dd:before { content:'\00bb';}

#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }

#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }

#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }

#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }

#logmsg table th.Corner { text-align: left; }

#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }

#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }

#patch { width: 100%; }

#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}

#patch .propset h4, #patch .binary h4 {margin:0;}

#patch pre {padding:0;line-height:1.2em;margin:0;}

#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}

#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}

#patch span {display:block;padding:0 10px;}

#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}

#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}

#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}

#patch .lines, .info {color:#888;background:#fff;}

--></style>

<div id="msg">

<dl class="meta">

<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/209424">209424</a></dd>

<dt>Author</dt> <dd>mark.lam@apple.com</dd>

<dt>Date</dt> <dd>2016-12-06 14:43:16 -0800 (Tue, 06 Dec 2016)</dd>

</dl>

<h3>Log Message</h3>

<pre>Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.

https://bugs.webkit.org/show_bug.cgi?id=165227

&lt;rdar://problem/29442665&gt;

Reviewed by Saam Barati.

JSTests:

* stress/get-from-scope-dynamic-onto-proxy.js:

- Updated error message.

* stress/proxy-dont-infinite-loop.js: Removed.

* stress/proxy-json-path.js: Removed.

* stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.

- Removed these tests because the issue they are testing relies on being able to

  set Object.prototype.__proto__ to something else (which is now not possible).

Source/JavaScriptCore:

* runtime/JSObject.cpp:

(JSC::JSObject::setPrototypeWithCycleCheck):

- This is where we check for immutable prototype exotic objects and refuse to set

  the prototype if needed.

  See https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.

* runtime/JSTypeInfo.h:

(JSC::TypeInfo::isImmutablePrototypeExoticObject):

* runtime/Structure.h:

- Add flag for declaring immutable prototype exotic objects.

* runtime/ObjectPrototype.h:

- Declare that Object.prototype is an immutable prototype exotic object.

  See https://tc39.github.io/ecma262/#sec-properties-of-the-object-prototype-object.

* runtime/ObjectConstructor.cpp:

(JSC::objectConstructorSetPrototypeOf):

- Use better error messages.

Source/WebCore:

Make all objects in window.__proto__'s prototype chain immutable prototype exotic

objects.  This gives us roughly equivalent behavior to other browsers.  

Firefox's behavior differ slightly in that Firefox will fail any attempted

assignment their __proto__, while the immutable prototype exotic objects will

only fail if the assignment is of a different value.  See

https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.

Chrome differs in that assignment to window.__proto__ is also handled like an

immutable prototype exotic object.  Instead we adhere to the current HTML spec

that says that the assignment should fail unconditionally.  See

https://html.spec.whatwg.org/#the-windowproxy-exotic-object and

https://html.spec.whatwg.org/#windowproxy-setprototypeof.

If the HTML spec is changed to make the WindowProxy and Location objects into

immutable prototype exotic objects later, we can update to match the spec then.

Test: js/prototype-assignment.html

* bindings/js/JSDOMWindowProperties.h:

* bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):

(GeneratePrototypeDeclaration):

* bindings/scripts/IDLAttributes.txt:

* dom/EventTarget.idl:

* page/DOMWindow.idl:

LayoutTests:

The new prototype-assignment.js test is currently only enabled for LLInt only

run in the JSC tests until webkit.org/b/165401 is fixed.

* TestExpectations:

- Skip js/prototype-assignment.html for now until webkit.org/b/165401 is fixed.

* http/tests/security/window-named-valueOf-expected.txt:

* js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt:

* js/dom/proxy-is-not-allowed-in-global-prototype-chain.html:

- Updated error messages.

* js/prototype-assignment-expected.txt: Added.

* js/prototype-assignment.html: Added.

* js/script-tests/prototype-assignment.js: Added.

(else):

(reportError):

(shouldEqual):

(shouldThrow):

(stringify):

(makeTestID):

(doInternalSetPrototypeOf):

(ordinarySetPrototypeOf):

(setImmutablePrototype):

(windowProxySetPrototypeOf):

(initSetterExpectation):

(throwIfNoExceptionPending):

(objectSetPrototypeOf):

(setUnderscoreProto):

(reflectSetPrototypeOf):

(newObjectProto.toString):

(this.testObject.targets.push.value):

(this.testProxy.targets.push.setPrototypeOf):

(Symbol):

(test):

(runTests):

* js/setPrototypeOf-expected.txt:</pre>

<h3>Modified Paths</h3>

<ul>

<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>

<li><a href="#trunkJSTestsstressgetfromscopedynamicontoproxyjs">trunk/JSTests/stress/get-from-scope-dynamic-onto-proxy.js</a></li>

<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>

<li><a href="#trunkLayoutTestsTestExpectations">trunk/LayoutTests/TestExpectations</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritywindownamedvalueOfexpectedtxt">trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomproxyisnotallowedinglobalprototypechainexpectedtxt">trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsdomproxyisnotallowedinglobalprototypechainhtml">trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain.html</a></li>

<li><a href="#trunkLayoutTestsjssetPrototypeOfexpectedtxt">trunk/LayoutTests/js/setPrototypeOf-expected.txt</a></li>

<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeObjectPrototypeh">trunk/Source/JavaScriptCore/runtime/ObjectPrototype.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>

<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowPropertiesh">trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptsIDLAttributestxt">trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt</a></li>

<li><a href="#trunkSourceWebCoredomEventTargetidl">trunk/Source/WebCore/dom/EventTarget.idl</a></li>

<li><a href="#trunkSourceWebCorepageDOMWindowidl">trunk/Source/WebCore/page/DOMWindow.idl</a></li>

</ul>

<h3>Added Paths</h3>

<ul>

<li><a href="#trunkLayoutTestsjsprototypeassignmentexpectedtxt">trunk/LayoutTests/js/prototype-assignment-expected.txt</a></li>

<li><a href="#trunkLayoutTestsjsprototypeassignmenthtml">trunk/LayoutTests/js/prototype-assignment.html</a></li>

<li><a href="#trunkLayoutTestsjsscripttestsprototypeassignmentjs">trunk/LayoutTests/js/script-tests/prototype-assignment.js</a></li>

</ul>

<h3>Removed Paths</h3>

<ul>

<li><a href="#trunkJSTestsstressproxydontinfiniteloopjs">trunk/JSTests/stress/proxy-dont-infinite-loop.js</a></li>

<li><a href="#trunkJSTestsstressproxyjsonpathjs">trunk/JSTests/stress/proxy-json-path.js</a></li>

<li><a href="#trunkJSTestsstressrestparameterallocationeliminationwatchpoints6js">trunk/JSTests/stress/rest-parameter-allocation-elimination-watchpoints-6.js</a></li>

</ul>

</div>

<div id="patch">

<h3>Diff</h3>

<a id="trunkJSTestsChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/JSTests/ChangeLog        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/JSTests/ChangeLog        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,3 +1,20 @@

</span><ins>+2016-12-06  Mark Lam  &lt;mark.lam@apple.com&gt;

+

+        Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.

+        https://bugs.webkit.org/show_bug.cgi?id=165227

+        &lt;rdar://problem/29442665&gt;

+

+        Reviewed by Saam Barati.

+

+        * stress/get-from-scope-dynamic-onto-proxy.js:

+        - Updated error message.

+

+        * stress/proxy-dont-infinite-loop.js: Removed.

+        * stress/proxy-json-path.js: Removed.

+        * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.

+        - Removed these tests because the issue they are testing relies on being able to

+          set Object.prototype.__proto__ to something else (which is now not possible).

+

</ins><span class="cx"> 2016-12-05  Caitlin Potter  &lt;caitp@igalia.com&gt;

</span><span class="cx"> 

</span><span class="cx">         [JSC] report unexpected token when &quot;async&quot; is followed by identifier 

</span></span></pre></div>

<a id="trunkJSTestsstressgetfromscopedynamicontoproxyjs"></a>

<div class="modfile"><h4>Modified: trunk/JSTests/stress/get-from-scope-dynamic-onto-proxy.js (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/JSTests/stress/get-from-scope-dynamic-onto-proxy.js        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/JSTests/stress/get-from-scope-dynamic-onto-proxy.js        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -103,4 +103,4 @@

</span><span class="cx">     thrown = e;

</span><span class="cx"> }

</span><span class="cx"> Object.prototype.__proto__ = null;

</span><del>-shouldBe(String(thrown), `Error: NG`);

</del><ins>+shouldBe(String(thrown), `TypeError: Cannot set prototype of immutable prototype object`);

</ins></span></pre></div>

<a id="trunkJSTestsstressproxydontinfiniteloopjs"></a>

<div class="delfile"><h4>Deleted: trunk/JSTests/stress/proxy-dont-infinite-loop.js (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/JSTests/stress/proxy-dont-infinite-loop.js        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/JSTests/stress/proxy-dont-infinite-loop.js        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,17 +0,0 @@

</span><del>-function foo() {

-    let target = {

-      __proto__: null

-    };

-    let proxy = new Proxy(target, {

-        get(...args) {

-            return Reflect.get(...args);

-        }

-    });

-    Object.prototype.__proto__ = {

-       __proto__: proxy,

-    };

-

-    let a = {};

-    a.test;

-}

-foo();

</del></span></pre></div>

<a id="trunkJSTestsstressproxyjsonpathjs"></a>

<div class="delfile"><h4>Deleted: trunk/JSTests/stress/proxy-json-path.js (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/JSTests/stress/proxy-json-path.js        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/JSTests/stress/proxy-json-path.js        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,25 +0,0 @@

</span><del>-var target = { __proto__: null };

-var handler = {

-    get: function ()

-    {

-        throw new Error(`ng`);

-    }

-};

-

-var thrown = null;

-var hello = 42;

-// As a result, global object automatically inherit this proxy.

-Object.prototype.__proto__ = {

-    __proto__: new Proxy(target, handler)

-};

-

-try {

-    loadString(`hello = {&quot;hello&quot;:&quot;world&quot;};proxy.ok = {}`);

-} catch (error) {

-    thrown = error;

-}

-Object.prototype.__proto__ = null;

-if (thrown === null)

-    throw new Error(`not thrown`);

-if (String(thrown) !== `Error: ng`)

-    throw new Error(`bad error: ${String(thrown)}`);

</del></span></pre></div>

<a id="trunkJSTestsstressrestparameterallocationeliminationwatchpoints6js"></a>

<div class="delfile"><h4>Deleted: trunk/JSTests/stress/rest-parameter-allocation-elimination-watchpoints-6.js (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/JSTests/stress/rest-parameter-allocation-elimination-watchpoints-6.js        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/JSTests/stress/rest-parameter-allocation-elimination-watchpoints-6.js        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,24 +0,0 @@

</span><del>-function assert(b) {

-    if (!b)

-        throw new Error;

-}

-noInline(assert);

-

-function foo(...args) {

-    return args[0];

-}

-noInline(foo);

-

-for (let i = 0; i &lt; 10000; i++) {

-    // Warm it up on both in bound and out of bound accesses.

-    if (i % 2)

-        assert(foo(i) === i);

-    else

-        assert(foo() === undefined);

-}

-

-let newProto = [50];

-newProto.__proto__ = null;

-Object.prototype.__proto__ = newProto;

-for (let i = 0; i &lt; 10000; i++)

-    assert(foo() === 50);

</del></span></pre></div>

<a id="trunkLayoutTestsChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/ChangeLog        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/LayoutTests/ChangeLog        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,3 +1,48 @@

</span><ins>+2016-12-06  Mark Lam  &lt;mark.lam@apple.com&gt;

+

+        Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.

+        https://bugs.webkit.org/show_bug.cgi?id=165227

+        &lt;rdar://problem/29442665&gt;

+

+        Reviewed by Saam Barati.

+

+        The new prototype-assignment.js test is currently only enabled for LLInt only

+        run in the JSC tests until webkit.org/b/165401 is fixed.

+

+        * TestExpectations:

+        - Skip js/prototype-assignment.html for now until webkit.org/b/165401 is fixed.

+

+        * http/tests/security/window-named-valueOf-expected.txt:

+        * js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt:

+        * js/dom/proxy-is-not-allowed-in-global-prototype-chain.html:

+        - Updated error messages.

+

+        * js/prototype-assignment-expected.txt: Added.

+        * js/prototype-assignment.html: Added.

+        * js/script-tests/prototype-assignment.js: Added.

+        (else):

+        (reportError):

+        (shouldEqual):

+        (shouldThrow):

+        (stringify):

+        (makeTestID):

+        (doInternalSetPrototypeOf):

+        (ordinarySetPrototypeOf):

+        (setImmutablePrototype):

+        (windowProxySetPrototypeOf):

+        (initSetterExpectation):

+        (throwIfNoExceptionPending):

+        (objectSetPrototypeOf):

+        (setUnderscoreProto):

+        (reflectSetPrototypeOf):

+        (newObjectProto.toString):

+        (this.testObject.targets.push.value):

+        (this.testProxy.targets.push.setPrototypeOf):

+        (Symbol):

+        (test):

+        (runTests):

+        * js/setPrototypeOf-expected.txt:

+

</ins><span class="cx"> 2016-12-06  Dave Hyatt  &lt;hyatt@apple.com&gt;

</span><span class="cx"> 

</span><span class="cx">         REGRESSION (Safari 10): Scrolling not working inside height 100% table

</span></span></pre></div>

<a id="trunkLayoutTestsTestExpectations"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/TestExpectations (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/TestExpectations        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/LayoutTests/TestExpectations        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -640,6 +640,8 @@

</span><span class="cx"> 

</span><span class="cx"> [ Debug ] js/regress-141098.html [ Slow ]

</span><span class="cx"> 

</span><ins>+webkit.org/b/165401 js/prototype-assignment.html [ Skip ]

+

</ins><span class="cx"> # IDBVersionChangeEvent tests need to be rewritten to use event constructors instead of createEvent,

<span class="cx"> # after we implement the IDBVersionChangeEvent constructor.

</span><span class="cx"> webkit.org/b/145390 storage/indexeddb/events.html [ Failure ]

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritywindownamedvalueOfexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,2 +1,2 @@

</span><del>-CONSOLE MESSAGE: line 1: Threw exception: TypeError: Illegal constructor

</del><ins>+CONSOLE MESSAGE: line 1: Threw exception: TypeError: Cannot set prototype of immutable prototype object

</ins><span class="cx"> This passes if it doesn't alert the contents of innocent-victim.  

</span></span></pre></div>

<a id="trunkLayoutTestsjsdomproxyisnotallowedinglobalprototypechainexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain-expected.txt        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -1,3 +1,2 @@

<del>-CONSOLE MESSAGE: TypeError: Proxy is not allowed in the global prototype chain.

-onerror saw TypeError: Proxy is not allowed in the global prototype chain.

</del><ins>+Caught: TypeError: Cannot set prototype of immutable prototype object

</ins><span class="cx"> 

</span></span></pre></div>

<a id="trunkLayoutTestsjsdomproxyisnotallowedinglobalprototypechainhtml"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain.html (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain.html        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/LayoutTests/js/dom/proxy-is-not-allowed-in-global-prototype-chain.html        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -18,7 +18,6 @@

</span><span class="cx"> 

</span><span class="cx"> } catch (e) {

</span><span class="cx">     log(&quot;Caught: &quot; + e);

</span><del>-    log(e.stack);

</del><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> function log(s)

</span></span></pre></div>

<a id="trunkLayoutTestsjsprototypeassignmentexpectedtxt"></a>

<div class="addfile"><h4>Added: trunk/LayoutTests/js/prototype-assignment-expected.txt (0 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/prototype-assignment-expected.txt                                (rev 0)

+++ trunk/LayoutTests/js/prototype-assignment-expected.txt        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -0,0 +1,4 @@

</span><ins>+PASS successfullyParsed is true

+

+TEST COMPLETE

+

</ins></span></pre></div>

<a id="trunkLayoutTestsjsprototypeassignmenthtml"></a>

<div class="addfile"><h4>Added: trunk/LayoutTests/js/prototype-assignment.html (0 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/prototype-assignment.html                                (rev 0)

+++ trunk/LayoutTests/js/prototype-assignment.html        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -0,0 +1,10 @@

</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;

+&lt;html&gt;

+&lt;head&gt;

+&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;

+&lt;/head&gt;

+&lt;body&gt;

+&lt;script src=&quot;script-tests/prototype-assignment.js&quot;&gt;&lt;/script&gt;

+&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;

+&lt;/body&gt;

+&lt;/html&gt;

</ins></span></pre></div>

<a id="trunkLayoutTestsjsscripttestsprototypeassignmentjs"></a>

<div class="addfile"><h4>Added: trunk/LayoutTests/js/script-tests/prototype-assignment.js (0 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/script-tests/prototype-assignment.js                                (rev 0)

+++ trunk/LayoutTests/js/script-tests/prototype-assignment.js        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -0,0 +1,438 @@

</span><ins>+//@ runFTLNoCJIT(&quot;--useJIT=false&quot;)

+// FIXME: Remove the &quot;--useJIT=false&quot; option when https://bugs.webkit.org/show_bug.cgi?id=165401 is fixed.

+

+// This test suite compares the behavior of setting the prototype on various values

+// (using Object.setPrototypeOf(), obj.__proto__ assignment, and Reflect.setPrototypeOf())

+// against what is specified in the ES spec.  The expected behavior specified according

+// to the spec is expressed in expectationsForObjectSetPrototypeOf,

+// expectationsForSetUnderscoreProto, and expectationsForReflectSetPrototypeOf.

+

+

+var inBrowser = (typeof window != &quot;undefined&quot;);

+

+// Test configuration options:

+var verbose = false;

+var maxIterations = 1;

+var throwOnEachError = true;

+

+var testUndefined = true;

+var testNull = true;

+var testTrue = true;

+var testFalse = true;

+var testNumbers = true;

+var testString = true;

+var testSymbol = true;

+var testObject = true;

+var testGlobal = true;

+var testWindowProtos = inBrowser;

+

+//====================================================================================

+// Error messages:

+

+if (inBrowser) {

+    let userAgent = navigator.userAgent;

+    if (userAgent.match(/ Chrome\/[0-9]+/)) engine = &quot;chrome&quot;;

+    else if (userAgent.match(/ Firefox\/[0-9]+/)) engine = &quot;default&quot;;

+    else engine = &quot;safari&quot;;

+} else

+    engine = &quot;jsc&quot;;

+

+// Set default error messages and then override with engine specific ones below.

+DefaultTypeError = &quot;TypeError: &quot;;

+CannotSetPrototypeOfImmutablePrototypeObject = DefaultTypeError;

+CannotSetPrototypeOfThisObject = DefaultTypeError;

+CannotSetPrototypeOfUndefinedOrNull = DefaultTypeError;

+CannotSetPrototypeOfNonObject = DefaultTypeError;

+PrototypeValueCanOnlyBeAnObjectOrNull = DefaultTypeError;

+ObjectProtoCalledOnNullOrUndefinedError = DefaultTypeError;

+ReflectSetPrototypeOfRequiresTheFirstArgumentBeAnObject = DefaultTypeError;

+ReflectSetPrototypeOfRequiresTheSecondArgumentBeAnObjectOrNull = DefaultTypeError;

+

+if (engine == &quot;jsc&quot; || engine === &quot;safari&quot;) {

+    CannotSetPrototypeOfImmutablePrototypeObject = &quot;TypeError: Cannot set prototype of immutable prototype object&quot;;

+    CannotSetPrototypeOfThisObject = &quot;TypeError: Cannot set prototype of this object&quot;;

+    CannotSetPrototypeOfUndefinedOrNull = &quot;TypeError: Cannot set prototype of undefined or null&quot;;

+    CannotSetPrototypeOfNonObject = &quot;TypeError: Cannot set prototype of non-object&quot;;

+    PrototypeValueCanOnlyBeAnObjectOrNull = &quot;TypeError: Prototype value can only be an object or null&quot;;

+    ObjectProtoCalledOnNullOrUndefinedError = &quot;TypeError: Object.prototype.__proto__ called on null or undefined&quot;;

+    ReflectSetPrototypeOfRequiresTheFirstArgumentBeAnObject = &quot;TypeError: Reflect.setPrototypeOf requires the first argument be an object&quot;;

+    ReflectSetPrototypeOfRequiresTheSecondArgumentBeAnObjectOrNull = &quot;TypeError: Reflect.setPrototypeOf requires the second argument be either an object or null&quot;;

+} else if (engine === &quot;chrome&quot;) {

+    CannotSetPrototypeOfImmutablePrototypeObject = &quot;TypeError: Immutable prototype object &quot;;

+}

+

+//====================================================================================

+// Utility functions:

+

+if (inBrowser)

+    print = console.log;

+

+function reportError(errorMessage) {

+    if (throwOnEachError)

+        throw errorMessage;

+    else

+        print(errorMessage);

+}

+

+function shouldEqual(testID, resultType, actual, expected) {

+    if (actual != expected)

+        reportError(&quot;ERROR in &quot; + resultType

+            + &quot;: expect &quot; + stringify(expected) + &quot;, actual &quot; + stringify(actual)

+            + &quot; in test: &quot; + testID.signature + &quot; on iteration &quot; + testID.iteration);

+}

+

+function shouldThrow(testID, resultType, actual, expected) {

+    let actualStr = &quot;&quot; + actual;

+    if (!actualStr.startsWith(expected))

+        reportError(&quot;ERROR in &quot; + resultType

+            + &quot;: expect &quot; + expected + &quot;, actual &quot; + actual

+            + &quot; in test: &quot; + testID.signature + &quot; on iteration &quot; + testID.iteration);

+}

+

+function stringify(value) {

+    if (typeof value == &quot;string&quot;) return '&quot;' + value + '&quot;';

+    if (typeof value == &quot;symbol&quot;) return value.toString();

+

+    if (value === origGlobalProto) return &quot;origGlobalProto&quot;; 

+    if (value === origObjectProto) return &quot;origObjectProto&quot;; 

+    if (value === newObjectProto) return &quot;newObjectProto&quot;;

+    if (value === proxyObject) return &quot;proxyObject&quot;;

+

+    if (value === null) return &quot;null&quot;;

+    if (typeof value == &quot;object&quot;) return &quot;object&quot;; 

+    return &quot;&quot; + value;

+}

+

+function makeTestID(index, iteration, targetName, protoToSet, protoSetter, expected) {

+    let testID = {};

+    testID.signature = &quot;[&quot; + index + &quot;] &quot;

+        + protoSetter.actionName + &quot;|&quot;

+        + targetName + &quot;|&quot;

+        + stringify(protoToSet) + &quot;|&quot;

+        + stringify(expected.result) + &quot;|&quot;

+        + stringify(expected.proto) + &quot;|&quot;

+        + stringify(expected.exception);

+    testID.iteration = iteration;

+    return testID;

+}

+

+//====================================================================================

+// Functions to express the expectations of the ES specification:

+

+function doInternalSetPrototypeOf(result, target, origProto, newProto) {

+    if (!target.setPrototypeOf) {

+        result.success = true;

+        result.exception = undefined;

+        return;

+    }

+    target.setPrototypeOf(result, origProto, newProto);

+}

+

+// 9.1.2.1 OrdinarySetPrototypeOf ( O, V )

+// https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof

+function ordinarySetPrototypeOf(result, currentProto, newProto) {

+    // 9.1.2.1-4 If SameValue(V, current) is true, return true.

+    if (newProto === currentProto) {

+        result.success = true;

+        return;

+    }

+    // 9.1.2.1-5 [extensibility check not tested here]

+    // 9.1.2.1-8 [cycle check not tested here]

+    result.success = true;

+}

+

+// 9.4.7.2 SetImmutablePrototype ( O, V )

+// https://tc39.github.io/ecma262/#sec-set-immutable-prototype

+function setImmutablePrototype(result, currentProto, newProto) {

+    if (newProto === currentProto) {

+        result.success = true;

+        return;

+    }

+    result.success = false;

+    result.exception = CannotSetPrototypeOfImmutablePrototypeObject;

+}

+

+// HTML spec: 7.4.2 [[SetPrototypeOf]] ( V )

+// https://html.spec.whatwg.org/#windowproxy-setprototypeof

+function windowProxySetPrototypeOf(result, currentProto, newProto) {

+    result.success = false;

+    result.exception = CannotSetPrototypeOfThisObject;

+}

+

+

+var count = 0;

+function initSetterExpectation(target, newProto) {

+    var targetValue = target.value();

+    var origProto = undefined;

+    if (targetValue != null &amp;&amp; targetValue != undefined)

+        origProto = targetValue.__proto__; // Default to old proto.

+

+    var expected = {};

+    expected.targetValue = targetValue;

+    expected.origProto = origProto;

+    expected.exception = undefined;

+    expected.proto = origProto;

+    expected.result = undefined;

+

+    return expected;

+}

+

+// 19.1.2.21 Object.setPrototypeOf ( O, proto )

+// https://tc39.github.io/ecma262/#sec-object.setprototypeof

+function objectSetPrototypeOf(target, newProto) {

+    let expected = initSetterExpectation(target, newProto);

+    var targetValue = expected.targetValue;

+    var origProto = expected.origProto;

+

+    function throwIfNoExceptionPending(e) {

+        if (!expected.exception)

+            expected.exception = e;

+    }

+

+    // 19.1.2.21-1 Let O be ? RequireObjectCoercible(O).

+    if (targetValue == undefined || targetValue == null)

+        throwIfNoExceptionPending(CannotSetPrototypeOfUndefinedOrNull);

+

+    // 19.1.2.21-2 If Type(proto) is neither Object nor Null, throw a TypeError exception.

+    if (typeof newProto != &quot;object&quot;)

+        throwIfNoExceptionPending(PrototypeValueCanOnlyBeAnObjectOrNull);

+

+    // 19.1.2.21-3 If Type(O) is not Object, return O.

+    else if (typeof targetValue != &quot;object&quot;)

+        expected.result = targetValue;

+

+    // 19.1.2.21-4 Let status be ? O.[[SetPrototypeOf]](proto).

+    else {

+        // 19.1.2.21-5 If status is false, throw a TypeError exception.

+        let result = {};

+        doInternalSetPrototypeOf(result, target, origProto, newProto);

+        if (result.success)

+            expected.proto = newProto;

+        else

+            throwIfNoExceptionPending(result.exception);

+

+        // 19.1.2.21-6 Return O.

+        expected.result = targetValue;

+    }

+

+    return expected;

+}

+objectSetPrototypeOf.action = (obj, newProto) =&gt; Object.setPrototypeOf(obj, newProto);

+objectSetPrototypeOf.actionName = &quot;Object.setPrototypeOf&quot;;

+

+

+// B.2.2.1.2 set Object.prototype.__proto__

+// https://tc39.github.io/ecma262/#sec-set-object.prototype.__proto__

+function setUnderscoreProto(target, newProto) {

+    let expected = initSetterExpectation(target, newProto);

+    var targetValue = expected.targetValue;

+    var origProto = expected.origProto;

+

+    function throwIfNoExceptionPending(e) {

+        if (!expected.exception)

+            expected.exception = e;

+    }

+

+    // B.2.2.1.2-1 Let O be ? RequireObjectCoercible(this value).

+    if (targetValue == undefined || targetValue == null)

+        throwIfNoExceptionPending(DefaultTypeError);

+

+    // B.2.2.1.2-2 If Type(proto) is neither Object nor Null, return undefined.

+    if (typeof newProto != &quot;object&quot;)

+        expected.result = undefined;

+    

+    // B.2.2.1.2-3 If Type(O) is not Object, return undefined.

+    else if (typeof targetValue != &quot;object&quot;)

+        expected.result = undefined;

+

+    // B.2.2.1.2-4 Let status be ? O.[[SetPrototypeOf]](proto).

+    else {

+        // B.2.2.1.2-5 If status is false, throw a TypeError exception.

+        let result = {};

+        doInternalSetPrototypeOf(result, target, origProto, newProto);

+        if (result.success)

+            expected.proto = newProto;

+        else

+            throwIfNoExceptionPending(result.exception);

+

+        // B.2.2.1.2-6 Return undefined.

+        expected.result = undefined;

+    }

+

+    // Override the result to be the newProto value because the statement obj.__proto__ = value

+    // will produce the rhs value, not the result of the obj.__proto__ setter.

+    expected.result = newProto;

+    return expected;    

+}

+setUnderscoreProto.action = (obj, newProto) =&gt; (obj.__proto__ = newProto);

+setUnderscoreProto.actionName = &quot;obj.__proto__&quot;;

+

+

+// 26.1.13 Reflect.setPrototypeOf ( target, proto )

+// https://tc39.github.io/ecma262/#sec-reflect.setprototypeof

+// function expectationsForReflectSetPrototypeOf(target, newProto, targetExpectation) {

+function reflectSetPrototypeOf(target, newProto) {

+    let expected = initSetterExpectation(target, newProto);

+    var targetValue = expected.targetValue;

+    var origProto = expected.origProto;

+

+    function throwIfNoExceptionPending(e) {

+        if (!expected.exception)

+            expected.exception = e;

+    }

+

+    // 26.1.13-1 If Type(target) is not Object, throw a TypeError exception.

+    if (targetValue === null || typeof targetValue != &quot;object&quot;)

+        throwIfNoExceptionPending(ReflectSetPrototypeOfRequiresTheFirstArgumentBeAnObject);

+

+    // 26.1.13-2 If Type(proto) is not Object and proto is not null, throw a TypeError exception.

+    if (typeof newProto != &quot;object&quot;)

+        throwIfNoExceptionPending(ReflectSetPrototypeOfRequiresTheSecondArgumentBeAnObjectOrNull);

+    

+    // 26.1.13-3 Return ? target.[[SetPrototypeOf]](proto).

+    let result = {};

+    doInternalSetPrototypeOf(result, target, origProto, newProto);

+    expected.result = result.success;

+    if (result.success)

+        expected.proto = newProto;

+

+    return expected;    

+}

+reflectSetPrototypeOf.action = (obj, newProto) =&gt; Reflect.setPrototypeOf(obj, newProto);

+reflectSetPrototypeOf.actionName = &quot;Reflect.setPrototypeOf&quot;;

+

+

+//====================================================================================

+// Test Data:

+

+var global = this;

+var origGlobalProto = global.__proto__;

+var origObjectProto = {}.__proto__;

+var proxyObject = new Proxy({ }, {

+    setPrototypeOf(target, value) {

+        throw &quot;Thrown from proxy&quot;;

+    }

+});

+var newObjectProto = { toString() { return &quot;newObjectProto&quot;; } };

+

+var targets = [];

+

+if (this.testUndefined) targets.push({ name: &quot;undefined&quot;, value: () =&gt; undefined });

+if (this.testNull)      targets.push({ name: &quot;null&quot;, value: () =&gt; null });

+if (this.testTrue)     targets.push({ name: &quot;true&quot;, value: () =&gt; true });

+if (this.testFalse)        targets.push({ name: &quot;false&quot;, value: () =&gt; false });

+

+if (this.testNumbers) {

+    targets.push({ name: &quot;0&quot;, value: () =&gt; 0 });

+    targets.push({ name: &quot;11&quot;, value: () =&gt; 11 });

+    targets.push({ name: &quot;123.456&quot;, value: () =&gt; 123.456 });

+}

+

+if (this.testString)    targets.push({ name: '&quot;doh&quot;', value: () =&gt; &quot;doh&quot; });

+if (this.testSymbol)    targets.push({ name: &quot;Symbol(doh)&quot;, value: () =&gt; Symbol(&quot;doh&quot;) });

+

+if (this.testObject) {

+    targets.push({

+        name: &quot;{}&quot;, 

+        value: () =&gt; {},

+        setPrototypeOf: ordinarySetPrototypeOf

+    });

+    targets.push({

+        name: &quot;{}.__proto__&quot;, 

+        value: () =&gt; origObjectProto,

+        setPrototypeOf: setImmutablePrototype

+    });

+}

+if (this.testGlobal) {

+    targets.push({

+        name: inBrowser ? &quot;window&quot; : &quot;global&quot;,

+        value: () =&gt; global,

+        setPrototypeOf: windowProxySetPrototypeOf

+    });

+}

+if (this.testWindowProtos) {

+    if (inBrowser) {

+        let depth = 1;

+        let proto = window.__proto__;

+        while (proto) { 

+            let name = &quot;window&quot;;

+            for (var i = 0; i &lt; depth; i++)

+                name += &quot;.__proto__&quot;;

+

+            let currentProto = proto;

+            targets.push({

+                name: name, 

+                value: () =&gt; currentProto,

+                setPrototypeOf: setImmutablePrototype

+            });

+

+            proto = proto.__proto__;

+            depth++;

+        }

+    }

+}

+

+

+var newProtos = [

+    undefined,

+    null,

+    true,

+    false,

+    0,

+    11,

+    123.456,

+    &quot;doh&quot;,

+    Symbol(&quot;doh&quot;),

+    {},

+    origObjectProto,

+    origGlobalProto,

+    newObjectProto

+];

+

+var protoSetters = [

+    objectSetPrototypeOf,

+    setUnderscoreProto,

+    reflectSetPrototypeOf,

+];

+

+

+//====================================================================================

+// Test driver functions:

+

+function test(testID, targetValue, newProto, setterAction, expected) {

+    let exception = undefined;

+    let result = undefined;

+    try {

+        result = setterAction(targetValue, newProto);

+    } catch (e) {

+        exception = e;

+    }

+    shouldThrow(testID, &quot;exception&quot;, exception, expected.exception);

+    if (!expected.exception) {

+        shouldEqual(testID, &quot;__proto__&quot;, targetValue.__proto__, expected.proto);

+        shouldEqual(testID, &quot;result&quot;, result, expected.result);

+    }

+}

+

+function runTests() {

+    let testIndex = 0;

+    for (protoSetter of protoSetters) {

+        for (target of targets) {

+            for (newProto of newProtos) {

+                let currentTestIndex = testIndex++;

+                for (var i = 0; i &lt; maxIterations; i++) {

+                    let expected = protoSetter(target, newProto);

+                    let targetValue = expected.targetValue;

+

+                    let testID = makeTestID(currentTestIndex, i, target.name, newProto, protoSetter, expected);

+                    if (verbose &amp;&amp; i == 0)

+                        print(&quot;test: &quot; + testID.signature);

+

+                    test(testID, targetValue, newProto, protoSetter.action, expected);

+                }

+            }

+        }

+    }

+}

+

+runTests();

</ins></span></pre></div>

<a id="trunkLayoutTestsjssetPrototypeOfexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/js/setPrototypeOf-expected.txt (209423 => 209424)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/js/setPrototypeOf-expected.txt        2016-12-06 22:38:45 UTC (rev 209423)

+++ trunk/LayoutTests/js/setPrototypeOf-expected.txt        2016-12-06 22:43:16 UTC (rev 209424)

</span><span class="lines">@@ -30,87 +30,87 @@

</span><span class="cx"> PASS Object.getPrototypeOf(value) is (value).__proto__

</span><span class="cx"> 

</span><span class="cx"> Non-Coercible value

<del>-PASS Object.setPrototypeOf(undefined, {}) threw exception TypeError: Type error.

-PASS Object.setPrototypeOf(null, {}) threw exception TypeError: Type error.

</del><ins>+PASS Object.setPrototypeOf(undefined, {}) threw exception TypeError: Cannot set prototype of undefined or null.

+PASS Object.setPrototypeOf(null, {}) threw exception TypeError: Cannot set prototype of undefined or null.

</ins><span class="cx"> 

</span><span class="cx"> Non-Object/Null proto

</span><span class="cx"> object (Function)

<del>-PASS Object.setPrototypeOf(object, 0) threw exception TypeError: Type error.

-PASS Object.setPrototypeOf(object, true) threw exception TypeError: Type error.

-PASS Object.setPrototypeOf(object, false) threw exception TypeError: Type error.

-PASS Object.setPrototypeOf(object, 'string') threw exception TypeError: Type error.

-PASS Object.setPrototypeOf(object, Symbol()) threw exception TypeError: Type error.

-PASS Object.setPrototypeOf(object, undefined) threw exception TypeError: Type error.