18fe546802
During ecma_collection_append the underlying collection was not increased in the required case. This triggered a buffer overflow when processing the bound function's arguments during call or during the Proxy ownKeys method. JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com
215 lines
5.0 KiB
JavaScript
215 lines
5.0 KiB
JavaScript
// Copyright JS Foundation and other contributors, http://js.foundation
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var target = {};
|
|
var handler = { ownKeys (target) {
|
|
throw 42;
|
|
}};
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
try {
|
|
// Array.prototype.sort
|
|
Array.prototype.sort.call(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e === 42);
|
|
}
|
|
|
|
try {
|
|
// 19.1.2.14.4
|
|
Object.keys(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e === 42);
|
|
}
|
|
|
|
try {
|
|
// 19.1.2.7.1
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e === 42);
|
|
}
|
|
|
|
try {
|
|
// 19.1.2.8.1
|
|
Object.getOwnPropertySymbols(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e === 42);
|
|
}
|
|
|
|
// test basic functionality
|
|
var target = { prop1: "prop1", prop2: "prop2"};
|
|
var handler = {
|
|
ownKeys: function(target) {
|
|
return ["foo", "bar"];
|
|
}
|
|
}
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
assert(JSON.stringify(Reflect.ownKeys(proxy)) === '["foo","bar"]');
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["foo","bar"]');
|
|
assert(JSON.stringify(Object.keys(proxy)) === '["foo","bar"]');
|
|
assert(JSON.stringify(Object.getOwnPropertySymbols(proxy)) === '["foo","bar"]');
|
|
|
|
handler.ownKeys = function(target) {return Object.getOwnPropertyNames(target);};
|
|
|
|
assert(JSON.stringify(Reflect.ownKeys(proxy)) === '["prop1","prop2"]');
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["prop1","prop2"]');
|
|
assert(JSON.stringify(Object.keys(proxy)) === '["prop1","prop2"]');
|
|
assert(JSON.stringify(Object.getOwnPropertySymbols(proxy)) === '["prop1","prop2"]');
|
|
|
|
// test with no trap
|
|
var target = { prop1: "prop1", prop2: "prop2"};
|
|
var handler = {};
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["prop1","prop2"]');
|
|
|
|
// test wtih "undefined" trap
|
|
var target = { prop1: "prop1", prop2: "prop2"};
|
|
var handler = {ownKeys: null};
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["prop1","prop2"]');
|
|
|
|
// test with invalid trap
|
|
var target = { prop1: "prop1", prop2: "prop2"};
|
|
var handler = {ownKeys: 42};
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
try {
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e instanceof TypeError);
|
|
}
|
|
|
|
// test when CreateListFromArrayLike called on non-object
|
|
var target = { prop1: "prop1", prop2: "prop2"};
|
|
var handler = {
|
|
ownKeys: function(target) {
|
|
return "foo";
|
|
}
|
|
};
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
try {
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e instanceof TypeError);
|
|
}
|
|
|
|
// test with invalid property key
|
|
var target = {};
|
|
var handler = {
|
|
ownKeys: function(target) {
|
|
return [5];
|
|
}
|
|
};
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
try {
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e instanceof TypeError);
|
|
}
|
|
|
|
// test with duplicated keys
|
|
var target = { prop1: "prop1", prop2: "prop2"};
|
|
var handler = {
|
|
ownKeys: function(target) {
|
|
return ["a", "a", "a"];
|
|
}
|
|
};
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["a","a","a"]');
|
|
|
|
// test with lots of keys
|
|
var keyslist = [];
|
|
|
|
var handler = {
|
|
ownKeys: function(target) {
|
|
for (var idx = 0; idx < 30; idx++) {
|
|
keyslist.push("K" + idx);
|
|
}
|
|
return keyslist;
|
|
}
|
|
};
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === JSON.stringify(keyslist));
|
|
|
|
// test when invariants gets violated
|
|
var target = {
|
|
"target_one": 1
|
|
};
|
|
Object.defineProperty(target, "nonconf", {value: 1, configurable: false});
|
|
|
|
var keys = ["foo"];
|
|
|
|
var handler = {
|
|
ownKeys: function(target) {
|
|
return keys;
|
|
}
|
|
};
|
|
|
|
var proxy = new Proxy(target, handler);
|
|
|
|
try {
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e instanceof TypeError);
|
|
}
|
|
|
|
keys = ["nonconf"];
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["nonconf"]');
|
|
|
|
Object.preventExtensions(target);
|
|
keys = ["foo", "nonconf"];
|
|
|
|
try {
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e instanceof TypeError);
|
|
}
|
|
|
|
keys = ["target_one", "nonconf"];
|
|
|
|
assert(JSON.stringify(Object.getOwnPropertyNames(proxy)) === '["target_one","nonconf"]');
|
|
|
|
keys = ["target_one", "nonconf", "foo"];
|
|
|
|
try {
|
|
Object.getOwnPropertyNames(proxy);
|
|
assert(false);
|
|
} catch (e) {
|
|
assert(e instanceof TypeError);
|
|
}
|