928083 - Incorrect MOP operation sequences in builtins

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

Incorrect MOP operation sequences are visible through Proxies, builtins should be audited to ensure they work as specified. 

For example Object.seal(), Array.prototype.pop(), Array.prototype.join() and Array.prototype.reverse() don't work as specified, to name just a few. A simple test script to log MOP operation sequences is available at https://gist.github.com/anba/fc8e71ed88f446663b0b .

Comment 1

[Tom S. (please needinfo tschuster)]

Doesn't seem like most of those examples in https://gist.github.com/anba/fc8e71ed88f446663b0b are still correct in the current ES6 version. But I don't doubt that we still have wrong behavior for some builtins.

Comment 2

[Tom S. (please needinfo tschuster)]

So I think the only problem that is left here that we invoke [[HasProperty]] in Array.prototype.join.  André could you confirm?

Comment 3

[André Bargull [:anba]]

(In reply to Tom Schuster [:evilpie] from comment #2)
> So I think the only problem that is left here that we invoke [[HasProperty]]
> in Array.prototype.join.  André could you confirm?

Yes, that's the only one left from the list in comment #0. But there are still other functions which need to be updated (I've only checked jsarray.cpp, builtin/Array.js, builtin/Object.cpp and builtin/Object.js):

- Object.create and Object.defineProperties (both use js::DefineProperties(...)): 

log = [];
Object.create(null, new Proxy({a: {value: 0}, b: {value: 1}}, new Proxy({}, {get(t,pk){log.push(pk)}}))); 
log.join();

Expected: "ownKeys,getOwnPropertyDescriptor,get,getOwnPropertyDescriptor,get"
Actual: "ownKeys,getOwnPropertyDescriptor,getOwnPropertyDescriptor,get,get"


log = [];
Object.defineProperties({}, new Proxy({a: {value: 0}, b: {value: 1}}, new Proxy({}, {get(t,pk){log.push(pk)}})));
log.join()

Expected: "ownKeys,getOwnPropertyDescriptor,get,getOwnPropertyDescriptor,get"
Actual: "ownKeys,getOwnPropertyDescriptor,getOwnPropertyDescriptor,get,get"


- Array.prototype.shift

log = [];
Array.prototype.shift.call(new Proxy([,], new Proxy({}, {get(t,pk){log.push(pk)}})));
log.join()

Expected: "get,get,deleteProperty,set,getOwnPropertyDescriptor,defineProperty"
Actual: "get,has,deleteProperty,set,getOwnPropertyDescriptor,defineProperty"

Comment 4

[André Bargull [:anba]]

I didn't find any further built-ins method which need to be updated except the ones reported in comment #3.

Comment 6

[Tom S. (please needinfo tschuster)]

We fixed all known issues here.