Upgrade to upstream WebKit 2e37adcc23b7

JSTests/microbenchmarks/json-stringify-short-strings-upconvert.js

@@ -0,0 +1,5 @@
+const value = { wide: "\u{1F600}" };
+for (let i = 0; i < 200; ++i)
+    value["abcdefgh" + i] = "ijklmnop" + i;
+for (let i = 0; i < 5e4; ++i)
+    JSON.stringify(value);

JSTests/stress/iterator-zip-object-prototype-pollution.js

@@ -0,0 +1,70 @@
+//@ requireOptions("--useJointIteration=1")
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: ${actual}, expected ${expected}`);
+}
+
+function makeIterator(values, log) {
+    var index = 0;
+    return {
+        next() {
+            if (index < values.length)
+                return { value: values[index++], done: false };
+            return { value: undefined, done: true };
+        },
+        return() {
+            log.push("return");
+            return { value: undefined, done: true };
+        },
+        [Symbol.iterator]() { return this; }
+    };
+}
+
+// GetOptionsObject must produce a null-prototype object when options is undefined,
+// so "mode" and "padding" lookups do not read through Object.prototype.
+{
+    Object.defineProperty(Object.prototype, "mode", { value: "strict", configurable: true });
+    Object.defineProperty(Object.prototype, "padding", { value: null, configurable: true });
+    try {
+        shouldBe(JSON.stringify(Array.from(Iterator.zip([[1, 2, 3], [4, 5]]))), "[[1,4],[2,5]]");
+        shouldBe(JSON.stringify(Array.from(Iterator.zipKeyed({ a: [1, 2, 3], b: [4, 5] }))), `[{"a":1,"b":4},{"a":2,"b":5}]`);
+    } finally {
+        delete Object.prototype.mode;
+        delete Object.prototype.padding;
+    }
+}
+
+// The synthetic underlying iterator's return() must be installed on a null-prototype object.
+// A non-writable Object.prototype.return must not make zip creation throw.
+{
+    Object.defineProperty(Object.prototype, "return", { value: 42, writable: false, configurable: true });
+    try {
+        var log = [];
+        shouldBe(JSON.stringify(Array.from(Iterator.zip([makeIterator([1], log), makeIterator([2], log)]))), "[[1,2]]");
+        shouldBe(JSON.stringify(Array.from(Iterator.zipKeyed({ a: makeIterator([1], log), b: makeIterator([2], log) }))), `[{"a":1,"b":2}]`);
+    } finally {
+        delete Object.prototype.return;
+    }
+}
+
+// An Object.prototype.return accessor must not swallow the closure: closing the zip result
+// closes the underlying iterators.
+{
+    Object.defineProperty(Object.prototype, "return", { get() { return undefined; }, set(v) { }, configurable: true });
+    try {
+        var log = [];
+        var zipped = Iterator.zip([makeIterator([1, 2, 3], log), makeIterator([4, 5, 6], log)]);
+        zipped.next();
+        zipped.return();
+        shouldBe(log.length, 2);
+
+        log = [];
+        var zippedKeyed = Iterator.zipKeyed({ a: makeIterator([1, 2, 3], log), b: makeIterator([4, 5, 6], log) });
+        zippedKeyed.next();
+        zippedKeyed.return();
+        shouldBe(log.length, 2);
+    } finally {
+        delete Object.prototype.return;
+    }
+}

JSTests/stress/json-stringify-enumerable-to-json.js

@@ -0,0 +1,71 @@
+function shouldBe(actual, expected)
+{
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function shouldThrow(func, errorType)
+{
+    let error;
+    try {
+        func();
+    } catch (e) {
+        error = e;
+    }
+    if (!(error instanceof errorType))
+        throw new Error(`bad error: ${String(error)}`);
+}
+
+// FastStringifier's property loop only tests for toJSON on the DontEnum branch, since that
+// branch is the one that would otherwise skip the entry. An enumerable own toJSON needs no
+// such test: a callable one fails the fast path when its value is appended, and a
+// non-callable one is serialized as an ordinary property, which is what the loop does.
+// These cases cover that reasoning; the expectations match V8.
+
+// An enumerable own callable toJSON is invoked.
+{
+    shouldBe(JSON.stringify({ a: 1, toJSON() { return 'method'; } }), '"method"');
+    shouldBe(JSON.stringify({ a: 1, toJSON: () => 'arrow' }), '"arrow"');
+    shouldBe(JSON.stringify({ a: 1, toJSON: function () { return { b: 2 }; } }), '{"b":2}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: function (key) { return key; } }), '""');
+    shouldBe(JSON.stringify({ key: { a: 1, toJSON: function (key) { return key; } } }), '{"key":"key"}');
+    shouldBe(JSON.stringify({ nested: { a: 1, toJSON() { return 42; } } }), '{"nested":42}');
+    shouldBe(JSON.stringify([{ a: 1, toJSON() { return [1]; } }]), '[[1]]');
+    shouldBe(JSON.stringify({ a: 1, toJSON: (function () { }).bind(null) }), undefined);
+    shouldBe(JSON.stringify({ a: 1, toJSON: new Proxy(function () { return 'proxy'; }, { }) }), '"proxy"');
+    shouldBe(JSON.stringify({ a: 1, toJSON: function* () { } }), '{}');
+    shouldThrow(() => JSON.stringify({ a: 1, toJSON: class C { } }), TypeError);
+}
+
+// An enumerable own non-callable toJSON is serialized as an ordinary property.
+{
+    shouldBe(JSON.stringify({ a: 1, toJSON: 42 }), '{"a":1,"toJSON":42}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: 'str' }), '{"a":1,"toJSON":"str"}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: true }), '{"a":1,"toJSON":true}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: null }), '{"a":1,"toJSON":null}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: undefined }), '{"a":1}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: { b: 2 } }), '{"a":1,"toJSON":{"b":2}}');
+    shouldBe(JSON.stringify({ a: 1, toJSON: [1, 2] }), '{"a":1,"toJSON":[1,2]}');
+    shouldBe(JSON.stringify({ toJSON: 'only' }), '{"toJSON":"only"}');
+}
+
+// The fast path and the general stringifier must agree, with and without a gap.
+{
+    let values = [
+        { a: 1, toJSON() { return 'method'; } },
+        { a: 1, toJSON: 42 },
+        { a: 1, toJSON: { nested: 1 } },
+        { a: 1, b: 2, c: 3, toJSON: 7 },
+        { toJSON: undefined, a: 1 },
+        { toJSON: 'only' },
+    ];
+    for (let value of values) {
+        for (let space of [undefined, 2, '\t'])
+            shouldBe(JSON.stringify(value, null, space), JSON.stringify(value, (key, x) => x, space));
+    }
+}
+
+for (let i = 0; i < testLoopCount; ++i) {
+    shouldBe(JSON.stringify({ a: 1, toJSON() { return 'hot'; } }), '"hot"');
+    shouldBe(JSON.stringify({ a: 1, toJSON: 42 }), '{"a":1,"toJSON":42}');
+}

JSTests/stress/object-toprimitive-fastpath-deopt.js

@@ -0,0 +1,95 @@
+function shouldBe(a, b) { if (a !== b) throw new Error("bad: " + a + " !== " + b); }
+
+// Scenario 1: overriding Object.prototype.toString must deopt all plain objects, then re-engage.
+(function () {
+    function O() {}
+    var a = new O();
+    for (var i = 0; i < testLoopCount; ++i)
+        shouldBe(`${a}`, "[object Object]");
+    a < 1;
+
+    var originalToString = Object.prototype.toString;
+    // Delete first: a plain reassignment leaves the memoized mode unable to return to Fast.
+    delete Object.prototype.toString;
+    Object.prototype.toString = function () { return "custom"; };
+    try {
+        shouldBe(`${a}`, "custom");
+        shouldBe(a + "", "custom");
+        shouldBe(String(a), "custom");
+
+        var b = new O();
+        shouldBe(`${b}`, "custom");
+    } finally {
+        // Restore as non-enumerable; a plain assignment would leave toString enumerable.
+        delete Object.prototype.toString;
+        Object.defineProperty(Object.prototype, "toString", {
+            value: originalToString,
+            writable: true,
+            enumerable: false,
+            configurable: true,
+        });
+    }
+
+    for (var i = 0; i < testLoopCount; ++i)
+        shouldBe(`${a}`, "[object Object]");
+    a < 1;
+})();
+
+// Scenario 2: an own Symbol.toPrimitive added after warmup must be honored, then removable.
+(function () {
+    function O() {}
+    var a = new O();
+    for (var i = 0; i < testLoopCount; ++i) {
+        shouldBe(`${a}`, "[object Object]");
+        shouldBe(a < 100, false);
+    }
+
+    a[Symbol.toPrimitive] = function (hint) {
+        if (hint === "number")
+            return 42;
+        if (hint === "string")
+            return "forty-two";
+        return "default-forty-two";
+    };
+
+    shouldBe(a < 100, true);
+    shouldBe(100 < a, false);
+    shouldBe(a + 1, "default-forty-two1");
+    shouldBe(`${a}`, "forty-two");
+    shouldBe(String(a), "forty-two");
+    shouldBe(Number(a), 42);
+
+    delete a[Symbol.toPrimitive];
+    for (var i = 0; i < testLoopCount; ++i) {
+        shouldBe(`${a}`, "[object Object]");
+        shouldBe(a < 100, false);
+    }
+})();
+
+// Scenario 3: a prototype Symbol.toStringTag added after warmup must be honored, then removable.
+(function () {
+    function Tagged() {}
+    var obj = new Tagged();
+    for (var i = 0; i < testLoopCount; ++i) {
+        shouldBe(Object.prototype.toString.call(obj), "[object Object]");
+        shouldBe(`${obj}`, "[object Object]");
+    }
+    obj < 1;
+
+    Tagged.prototype[Symbol.toStringTag] = "Tag";
+
+    shouldBe(Object.prototype.toString.call(obj), "[object Tag]");
+    shouldBe(`${obj}`, "[object Tag]");
+    shouldBe(obj + "", "[object Tag]");
+    shouldBe(String(obj), "[object Tag]");
+
+    function Plain() {}
+    var plain = new Plain();
+    shouldBe(`${plain}`, "[object Object]");
+
+    delete Tagged.prototype[Symbol.toStringTag];
+    for (var i = 0; i < testLoopCount; ++i) {
+        shouldBe(`${obj}`, "[object Object]");
+        obj < 1;
+    }
+})();

JSTests/stress/object-toprimitive-fastpath-overrides.js

@@ -0,0 +1,127 @@
+function shouldBe(a, b) { if (a !== b) throw new Error("bad: " + a + " !== " + b); }
+
+// Objects with an own or exotic override must always take the full, spec-compliant slow path.
+
+// own valueOf returning a number.
+(function () {
+    var v = { valueOf() { return 5; } };
+    shouldBe(v < 10, true);
+    shouldBe(v + 1, 6);
+})();
+
+// own toString.
+(function () {
+    var s = { toString() { return "z"; } };
+    shouldBe(`${s}`, "z");
+})();
+
+// own Symbol.toPrimitive.
+(function () {
+    var tp = { [Symbol.toPrimitive](hint) { return hint; } };
+    shouldBe(`${tp}`, "string");
+    shouldBe(Number.isNaN(+tp), true);
+    shouldBe(tp + "", "default");
+})();
+
+// own Symbol.toStringTag.
+(function () {
+    var tag = { [Symbol.toStringTag]: "X" };
+    shouldBe(`${tag}`, "[object X]");
+})();
+
+// Mixed-operand relational compares against a plain object.
+(function () {
+    var o = {};
+    shouldBe(o < 5, false);
+    shouldBe(1 < o, false);
+    shouldBe("a" < o, false);
+    shouldBe(o < "b", true);
+    shouldBe(o <= 5, false);
+    shouldBe(5 <= o, false);
+    shouldBe(o > 5, false);
+    shouldBe(o >= 5, false);
+})();
+
+// Arrays use their own fast path, not the plain-object one.
+(function () {
+    shouldBe([1, 2] < [1, 3], true);
+})();
+
+// Object.create(null) has no toString/valueOf/toPrimitive, so ToPrimitive throws.
+(function () {
+    var n = Object.create(null);
+    var threw = false;
+    try {
+        `${n}`;
+    } catch (e) {
+        threw = e instanceof TypeError;
+    }
+    shouldBe(threw, true);
+
+    threw = false;
+    try {
+        n + 1;
+    } catch (e) {
+        threw = e instanceof TypeError;
+    }
+    shouldBe(threw, true);
+
+    threw = false;
+    try {
+        n < 5;
+    } catch (e) {
+        threw = e instanceof TypeError;
+    }
+    shouldBe(threw, true);
+})();
+
+// Object identity (a == b) is unaffected, same-realm and cross-realm.
+(function () {
+    var a = {}, b = {};
+    shouldBe(a == b, false);
+    shouldBe(a == a, true);
+
+    var other = createGlobalObject();
+    var otherObjectCtor = other.Object;
+    var crossA = new otherObjectCtor();
+    var crossB = new otherObjectCtor();
+    shouldBe(crossA == crossB, false);
+    shouldBe(crossA == crossA, true);
+})();
+
+// Cross-realm: the verdict must be computed against the object's own realm, so an override on
+// the other realm's Object.prototype.toString is honored when coercing from the main realm.
+(function () {
+    var other = createGlobalObject();
+    var o = new other.Object();
+
+    var p = new other.Object();
+    for (var i = 0; i < testLoopCount; ++i) {
+        o < p;
+        o <= p;
+        `${o}`;
+    }
+
+    shouldBe(`${o}`, "[object Object]");
+    shouldBe(o + "", "[object Object]");
+    shouldBe(String(o), "[object Object]");
+    shouldBe(o < o, false);
+    shouldBe(o <= o, true);
+    shouldBe(o > o, false);
+    shouldBe(o >= o, true);
+
+    other.Object.prototype.toString = function () { return "custom-other-realm"; };
+    shouldBe(`${o}`, "custom-other-realm");
+    shouldBe(o + "", "custom-other-realm");
+    shouldBe(String(o), "custom-other-realm");
+})();
+
+// The default fast path coexists with all the overridden cases above without cross-contamination.
+(function () {
+    function Plain() {}
+    var p = new Plain();
+    for (var i = 0; i < testLoopCount; ++i) {
+        shouldBe(`${p}`, "[object Object]");
+        shouldBe(p < 5, false);
+    }
+})();