From 7e0b478fe9f9940ad40d04a1522b7b90b8876f2a Mon Sep 17 00:00:00 2001 From: Robert Fancsik Date: Tue, 28 Jul 2020 10:45:51 +0200 Subject: [PATCH] Update Array.prototype.concat error handling to ES11 (#4071) This patch fixes #4044. JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu --- .../builtin-objects/ecma-builtin-helpers.c | 26 ++++++++++++++--- .../es.next/regression-test-issue-4044.js | 28 +++++++++++++++++++ 2 files changed, 50 insertions(+), 4 deletions(-) create mode 100644 tests/jerry/es.next/regression-test-issue-4044.js diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.c b/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.c index f7f8d5c70..c972a978e 100644 --- a/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.c +++ b/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.c @@ -301,7 +301,11 @@ ecma_builtin_helper_array_concat_value (ecma_object_t *array_obj_p, /**< array * } bool spread_object = is_spreadable == ECMA_VALUE_TRUE; + /* ES11: 22.1.3.1.5.c.iv.3.b */ + const uint32_t prop_flags = ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE | ECMA_IS_THROW; #else /* !ENABLED (JERRY_ESNEXT) */ + /* ES5.1: 15.4.4.4.5.b.iii.3.b */ + const uint32_t prop_flags = ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE; bool spread_object = ecma_is_value_true (ecma_is_value_array (value)); #endif /* ENABLED (JERRY_ESNEXT) */ @@ -342,10 +346,16 @@ ecma_builtin_helper_array_concat_value (ecma_object_t *array_obj_p, /**< array * ecma_value_t put_comp = ecma_builtin_helper_def_prop_by_index (array_obj_p, *length_p + array_index, get_value, - ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE); - - JERRY_ASSERT (ecma_is_value_true (put_comp)); + prop_flags); ecma_free_value (get_value); +#if ENABLED (JERRY_ESNEXT) + if (ECMA_IS_VALUE_ERROR (put_comp)) + { + return put_comp; + } +#else /* !ENABLED (JERRY_ESNEXT) */ + JERRY_ASSERT (ecma_is_value_true (put_comp)); +#endif /* ENABLED (JERRY_ESNEXT) */ } *length_p += arg_len; @@ -357,8 +367,16 @@ ecma_builtin_helper_array_concat_value (ecma_object_t *array_obj_p, /**< array * ecma_value_t put_comp = ecma_builtin_helper_def_prop_by_index (array_obj_p, (*length_p)++, value, - ECMA_PROPERTY_CONFIGURABLE_ENUMERABLE_WRITABLE); + prop_flags); + +#if ENABLED (JERRY_ESNEXT) + if (ECMA_IS_VALUE_ERROR (put_comp)) + { + return put_comp; + } +#else /* !ENABLED (JERRY_ESNEXT) */ JERRY_ASSERT (ecma_is_value_true (put_comp)); +#endif /* ENABLED (JERRY_ESNEXT) */ return ECMA_VALUE_EMPTY; } /* ecma_builtin_helper_array_concat_value */ diff --git a/tests/jerry/es.next/regression-test-issue-4044.js b/tests/jerry/es.next/regression-test-issue-4044.js new file mode 100644 index 000000000..0baf98b8f --- /dev/null +++ b/tests/jerry/es.next/regression-test-issue-4044.js @@ -0,0 +1,28 @@ +// Copyright JS Foundation and other contributors, http://js.foundation +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +var a = Int32Array.prototype; +a.__proto__ = []; + +var b = a.splice(7, -4, 8, 9, 10); + +b.__proto__ = a; +b.length = 5; + +try { + b = b.concat([]); + assert(false); +} catch (e) { + assert(e instanceof TypeError); +}