[Webkit-unassigned] [Bug 151596] [JSC] add missing RequireObjectCoercible() step in destructuring

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=151596

Darin Adler <darin at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #266145|review?                     |review+
              Flags|                            |

--- Comment #2 from Darin Adler <darin at apple.com> ---
Comment on attachment 266145
  --> https://bugs.webkit.org/attachment.cgi?id=266145
[JSC] add missing RequireObjectCoercible() step in destructuring

View in context: https://bugs.webkit.org/attachment.cgi?id=266145&action=review

> Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:3849
> +    emitJumpIfFalse(emitIsUndefined(newTemporary(), value), isNotUndefined.get());

We can save a branch in the normal expected fast path by doing the other check first; then do emitIsUndefined only the failure case to chose which error to throw; undefined is equal to null from the point of view of op_eq_null.

> Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:3853
> +    emitJumpIfFalse(emitUnaryOp(op_eq_null, newTemporary(), value), target.get());

Unfortunately this emits the “masquerades as null” checking code, so it’s unnecessarily slow. Here we are not literally checking == null so we don’t want that extra logic; it just slows us down. One way to do this would be to add a new op_is_undefined_or_null that doesn’t bother with the masquerading logic. Or op_is_object_coercible.

> Source/JavaScriptCore/tests/stress/destructuring-assignment-require-object-coercible.js:15
> +testTypeError(`({ } = null)`, "TypeError: null is not an object");

Would be much better to check all the other types here too, an object, number, boolean, string, and especially a “masquerades as null” value, making sure that they do not throw a type error.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151130/041d26f1/attachment.html>