After the introduction of the Proxy builtin object there was
a possibility to traverse the prototype chain with an invalid object.
The prototype was freed before it's data/properties were queried resulting
in accessing invalid information.
By forcing the allocator to always do a gc (`--mem-stres-test=on` build option)
it was possible to trigger the issue without complicated tests.
New internal method:
* `ecma_op_object_get_prototype_of` which always returns the prototype
of an object and the return value must be freed (if it is valid).
Updated prototype chain traversing in:
* `jerry_object_get_property_names`
* `ecma_builtin_object_prototype_lookup_getter_setter`
* `ecma_op_function_has_instance`
* `ecma_op_function_get_super_constructor`
* `ecma_op_object_is_prototype_of`
* `ecma_op_object_enumerate`
Removed method `ecma_proxy_object_prototype_to_cp`
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
When the mem-stress-test is enabled for the objects foreach unittest
the object counting is off by one. This was due to incorrect assumption
on when the gc is triggered.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
In Proxy.[[Get]] if the target.[[GetOwnPropertyDescriptor]] fails the
trap result should be freed.
Fixes: #4466
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
After #4372 and #4369 all builtin constructors have new target support.
This patch fixes#4446.
JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik [email protected]
based on ECMA-262 v11, B.2.1.2
Fixed tests from the exclude list:
* annexB/built-ins/unescape/four-ignore-bad-u.js
* annexB/built-ins/unescape/four.js
* annexB/built-ins/unescape/two.js
JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
When accessing an error's type there is no need to check the Proxy
prototype (as there is none).
Fixes: #4440
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
Normally, it is more usual and safe to use a toolchain's native
math library. Especially, if multiple components of a project use
math functions, in which case all components should be linked
against the same libm.
The libjerry-math can be used, of course, but as it needs extra
care and consideration, it should be opt-in.
JerryScript-DCO-1.0-Signed-off-by: Akos Kiss [email protected]
When shifting a negative BigInt value if the
shift count is very "big" the result should be -1.
eg.:
```
(-2n >> (2n*32n)) === -1n
```
Note: the `-2n >> (2n*31n)` already returned `-1n` prior this change.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
Proxy flags (IsCallable, IsConstructor) can't be stored on the
property list compressed pointer. As adding a Proxy to a WeakSet
would add a property to the Proxy object causing failures down the line.
The prototype internal "slot" can be used to store there flags as
it is not used in case of Proxies (as per standard).
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
That "libm" in the name of the library resulted in awkward naming
on *nix systems (`libjerry-libm.*`, "lib" occurring twice). And the
name of the corresponding header is `math.h` anyway.
Note that this is a breaking change in some sense. The commit
contains no API change, but the build system does change for users
of the math library.
JerryScript-DCO-1.0-Signed-off-by: Akos Kiss [email protected]
When an error occurs accessing a property during JSON stringify call
the wrapper object is not freed at the correct place.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
Extended the `jerry_type_t` enum with `JERRY_TYPE_BIGINT` and added it to
the `jerry_value_get_type`.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
The assert in the reduce and filter methods did not checked if the given value
is a BigInt. This missing check caused the assert to fail.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
- Rework symbols to have the same value across realms
- Support realms for native functions
- Support test262
- Use new.target realms for constructing intrinsics
JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg [email protected]
- Type for realm objects is introduced (ecma_global_object_t)
- Realm reference is added to built-in objects and ECMAScript functions
- Resolving built-ins, global environments, and scopes require realm object
- Unnecessary global object accesses are removed from the code
Missing: external functions and static snapshot functions have no realm reference
JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg [email protected]
Few test-cases in test262 uses a $262 object to run a few method (for example detachedArrayBuffer)
JerryScript-DCO-1.0-Signed-off-by: bence gabor kis [email protected]
The handling of Proxy.[[Get]] was not fully correctly in the case when the
Proxy was revoked during the execution of the handler.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
The previous `ecma_is_constructor` implementation did not checked if the
target function was an arrow or generator function. This resulted in
an incorrect execution for these function types.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
Yonggang Luo