[Webkit-unassigned] [Bug 239797] New: %ThrowTypeError% is defined more than once per realm

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=239797

            Bug ID: 239797
           Summary: %ThrowTypeError% is defined more than once per realm
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: richard.gibson at gmail.com

This is a JavaScriptCore analog of SpiderMonkey https://bugzilla.mozilla.org/show_bug.cgi?id=1484547

https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-addrestrictedfunctionproperties and https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-createunmappedargumentsobject specify that the getter and setter for each of `Function.prototype` "caller", `Function.prototype` "arguments", and strict-mode function body `arguments` "callee" should all be the same %ThrowTypeError% built-in function. However, JavaScriptCore returns a distinct value for all but the getter/setter pair for strict-mode `arguments` "callee":

```js
(function(){
  "use strict";
  const inputs = [
    ["Function.prototype `caller` getter", Object.getOwnPropertyDescriptor(Function.prototype, "caller").get],
    ["Function.prototype `caller` setter", Object.getOwnPropertyDescriptor(Function.prototype, "caller").set],
    ["Function.prototype `arguments` getter", Object.getOwnPropertyDescriptor(Function.prototype, "arguments").get],
    ["Function.prototype `arguments` setter", Object.getOwnPropertyDescriptor(Function.prototype, "arguments").set],
    ["arguments `callee` getter", Object.getOwnPropertyDescriptor(arguments, "callee").get],
    ["arguments `callee` setter", Object.getOwnPropertyDescriptor(arguments, "callee").set],
  ];
  const groups = new Map();
  for (let [label, fn] of new Map(inputs)) {
    const group = groups.get(fn) || groups.set(fn, []).get(fn);
    group.push(label);
  }
  return JSON.stringify([...groups.values()], null, 2);
})()
/* =>
[
  [
    "Function.prototype `caller` getter"
  ],
  [
    "Function.prototype `caller` setter"
  ],
  [
    "Function.prototype `arguments` getter"
  ],
  [
    "Function.prototype `arguments` setter"
  ],
  [
    "arguments `callee` getter",
    "arguments `callee` setter"
  ]
]
*/
```

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220427/a6ff7aaf/attachment.htm>