After the introduction of the Proxy builtin object there was
a possibility to traverse the prototype chain with an invalid object.
The prototype was freed before it's data/properties were queried resulting
in accessing invalid information.
By forcing the allocator to always do a gc (`--mem-stres-test=on` build option)
it was possible to trigger the issue without complicated tests.
New internal method:
* `ecma_op_object_get_prototype_of` which always returns the prototype
of an object and the return value must be freed (if it is valid).
Updated prototype chain traversing in:
* `jerry_object_get_property_names`
* `ecma_builtin_object_prototype_lookup_getter_setter`
* `ecma_op_function_has_instance`
* `ecma_op_function_get_super_constructor`
* `ecma_op_object_is_prototype_of`
* `ecma_op_object_enumerate`
Removed method `ecma_proxy_object_prototype_to_cp`
JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com
After ES5.1 if the delete returns false a TypeError should be thrown
in strict mode.
JerryScript-DCO-1.0-Signed-off-by: Peter Gal pgal.usz@partner.samsung.com
I've removed the ecma_op_object_get_property_names method, and implemented the following ones:
- ecma_op_object_own_property_keys: this is now the internal [[OwnPropertyKeys]] method
- ecma_op_object_enumerate: this is used for the for-in iterator
- ecma_object_sort_property_names: this is used for sorting the property names of an object
- ecma_object_list_lazy_property_names: this is for getting the lazy instantiated properties
- ecma_object_prop_name_is_duplicated: this is for checking if a given property is duplicated in an object
Also the for-in operation with Proxy object works with this patch, #3992 should be closed
JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi aszilagy@inf.u-szeged.hu
Now the following conventions are applied:
- passing the number of arguments for a function call is always uint32_t
- string size/length/position related operation should use lit_utf8_size_t
- Extended objects internal fields must be uint32_t
JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
A list of changes:
- 'es2015-subset' profile is deprecated, and an 'es.next' profile is added.
- The default profile is changed to 'es.next'
- Renamed the JERRY_ES2015 guard to JERRY_ESNEXT
- Renamed JERRY_ES2015_BUILTIN_* guards to JERRY_BUILTIN_*
- Moved es2015 specific tests to a new 'es.next' subdirectory
- Updated docs, targets, and test runners to reflect these changes
Resolves#3737.
JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu
Changes:
- Use the pre-scanner to provide information for the parser about the existence of the class constructor
- The allocation of the super declarative environment is no longer needed
- The VM frame context holds the information about the this binding status
- Reduce the number of class related VM/CBC instructions
- Improve ecma_op_function_{construct, call} to properly set new.target
JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
- Internal routines of the of the proxy object are unimplemented
- For-in enumerate with proxy target is currently not supported
JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
