mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1609432 - Part 2: Always use callContentFunction and constructContentFunction for possibly user-provided functions. r=jandem 

Use `callContentFunction` even if `this` value is `undefined`.
Use `constructContentFunction` even if `newTarget` value is constructor itself.

Differential Revision: https://phabricator.services.mozilla.com/D152344
This commit is contained in:
Tooru Fujisawa 2022-07-26 02:37:49 +00:00
Родитель 734c6f314c
Коммит 6772da8761
6 изменённых файлов: 62 добавлений и 35 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

13
js/src/builtin/Array.js
Просмотреть файл

@ -422,7 +422,8 @@ function ArrayReduce(callbackfn/*, initialValue*/) {
/* Step b */
if (k in O) {
/* Step c. */
accumulator = callbackfn(accumulator, O[k], k, O);
accumulator = callContentFunction(callbackfn, undefined,
accumulator, O[k], k, O);
}
}
@ -481,7 +482,8 @@ function ArrayReduceRight(callbackfn/*, initialValue*/) {
/* Step b */
if (k in O) {
/* Step c. */
accumulator = callbackfn(accumulator, O[k], k, O);
accumulator = callContentFunction(callbackfn, undefined,
accumulator, O[k], k, O);
}
}
@ -772,7 +774,7 @@ function ArrayFrom(items, mapfn = undefined, thisArg = undefined) {
ThrowTypeError(JSMSG_NOT_ITERABLE, DecompileArg(0, items));
// Steps 5.a-b.
var A = IsConstructor(C) ? new C() : [];
var A = IsConstructor(C) ? constructContentFunction(C, C) : [];
// Step 5.c.
var iterator = MakeIteratorWrapper(items, usingIterator);
@ -814,7 +816,8 @@ function ArrayFrom(items, mapfn = undefined, thisArg = undefined) {
var len = ToLength(arrayLike.length);
// Steps 12-14.
var A = IsConstructor(C) ? new C(len) : std_Array(len);
var A = IsConstructor(C) ? constructContentFunction(C, C, len)
: std_Array(len);
// Steps 15-16.
for (var k = 0; k < len; k++) {
@ -971,7 +974,7 @@ function ArraySpeciesCreate(originalArray, length) {
ThrowTypeError(JSMSG_NOT_CONSTRUCTOR, "constructor property");
// Step 8.
return new C(length);
return constructContentFunction(C, C, length);
}
// ES 2017 draft (April 8, 2016) 22.1.3.1.1

4
js/src/builtin/Promise.js
Просмотреть файл

@ -30,7 +30,7 @@ function Promise_finally(onFinally) {
// Steps 1-2 (implicit).
// Step 3.
var result = onFinally();
var result = callContentFunction(onFinally, undefined);
// Steps 4-5 (implicit).
@ -50,7 +50,7 @@ function Promise_finally(onFinally) {
// Steps 1-2 (implicit).
// Step 3.
var result = onFinally();
var result = callContentFunction(onFinally, undefined);
// Steps 4-5 (implicit).

44
js/src/builtin/RegExp.js
Просмотреть файл

@ -485,15 +485,25 @@ function RegExpGetComplexReplacement(result, matched, S, position,
if (namedCaptures === undefined) {
switch (nCaptures) {
case 0:
return ToString(replaceValue(SPREAD(captures, 1), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(captures, 1),
position, S));
case 1:
return ToString(replaceValue(SPREAD(captures, 2), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(captures, 2),
position, S));
case 2:
return ToString(replaceValue(SPREAD(captures, 3), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(captures, 3),
position, S));
case 3:
return ToString(replaceValue(SPREAD(captures, 4), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(captures, 4),
position, S));
case 4:
return ToString(replaceValue(SPREAD(captures, 5), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(captures, 5),
position, S));
}
}
// Steps 14.k.ii-v.
@ -533,15 +543,25 @@ function RegExpGetFunctionalReplacement(result, S, position, replaceValue) {
if (namedCaptures === undefined) {
switch (nCaptures) {
case 0:
return ToString(replaceValue(SPREAD(result, 1), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(result, 1),
position, S));
case 1:
return ToString(replaceValue(SPREAD(result, 2), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(result, 2),
position, S));
case 2:
return ToString(replaceValue(SPREAD(result, 3), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(result, 3),
position, S));
case 3:
return ToString(replaceValue(SPREAD(result, 4), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(result, 4),
position, S));
case 4:
return ToString(replaceValue(SPREAD(result, 5), position, S));
return ToString(callContentFunction(replaceValue, undefined,
SPREAD(result, 5),
position, S));
}
}
@ -839,7 +859,7 @@ function RegExpSplit(string, limit) {
newFlags = flags + "y";
// Step 10.
splitter = new C(rx, newFlags);
splitter = constructContentFunction(C, C, rx, newFlags);
}
// Step 11.
@ -1167,7 +1187,7 @@ function RegExpMatchAll(string) {
flags = ToString(rx.flags);
// Step 6.
matcher = new C(rx, flags);
matcher = constructContentFunction(C, C, rx, flags);
// Steps 7-8.
matcher.lastIndex = ToLength(rx.lastIndex);

8
js/src/builtin/Set.js
Просмотреть файл

@ -40,7 +40,7 @@ function SetUnion(iterable) {
var Ctr = SpeciesConstructor(set, GetBuiltinConstructor("Set"));
// Step 4. Let newSet be ? Construct(Ctr, set).
var newSet = new Ctr(set);
var newSet = constructContentFunction(Ctr, Ctr, set);
// Step 5. Let adder be ? Get(newSet, "add").
var adder = newSet.add;
@ -75,7 +75,7 @@ function SetIntersection(iterable) {
var Ctr = SpeciesConstructor(set, GetBuiltinConstructor("Set"));
// Step 4. Let newSet be ? Construct(Ctr).
var newSet = new Ctr();
var newSet = constructContentFunction(Ctr, Ctr);
// Step 5. Let hasCheck be ? Get(set, "has").
var hasCheck = set.has;
@ -160,7 +160,7 @@ function SetDifference(iterable) {
var Ctr = SpeciesConstructor(set, GetBuiltinConstructor("Set"));
// Step 4. Let newSet be ? Construct(Ctr, set).
var newSet = new Ctr(set);
var newSet = constructContentFunction(Ctr, Ctr, set);
// Step 5. Let remover be ? Get(newSet, "delete").
var remover = newSet.delete;
@ -220,7 +220,7 @@ function SetSymmetricDifference(iterable) {
var Ctr = SpeciesConstructor(set, GetBuiltinConstructor("Set"));
// Step 4. Let newSet be ? Construct(Ctr, set).
var newSet = new Ctr(set);
var newSet = constructContentFunction(Ctr, Ctr, set);
// Step 5. Let remover be ? Get(newSet, "delete").
var remover = newSet.delete;

12
js/src/builtin/Sorting.js
Просмотреть файл

@ -13,7 +13,7 @@ function InsertionSort(array, from, to, comparefn) {
item = array[i];
for (j = i - 1; j >= from; j--) {
swap = array[j];
if (comparefn(swap, item) <= 0)
if (callContentFunction(comparefn, undefined, swap, item) <= 0)
break;
array[j + 1] = swap;
}
@ -28,7 +28,8 @@ function InsertionSort(array, from, to, comparefn) {
function Merge(list, out, start, mid, end, comparefn) {
// Skip lopsided runs to avoid doing useless work.
// Skip calling the comparator if the sub-list is already sorted.
if (mid >= end || comparefn(list[mid], list[mid + 1]) <= 0) {
if (mid >= end || callContentFunction(comparefn, undefined,
list[mid], list[mid + 1]) <= 0) {
for (var i = start; i <= end; i++) {
DefineDataProperty(out, i, list[i]);
}
@ -41,7 +42,7 @@ function Merge(list, out, start, mid, end, comparefn) {
while (i <= mid && j <= end) {
var lvalue = list[i];
var rvalue = list[j];
if (comparefn(lvalue, rvalue) <= 0) {
if (callContentFunction(comparefn, undefined, lvalue, rvalue) <= 0) {
DefineDataProperty(out, k++, lvalue);
i++;
} else {
@ -129,7 +130,8 @@ function MergeSort(array, len, comparefn) {
function MergeTypedArray(list, out, start, mid, end, comparefn) {
// Skip lopsided runs to avoid doing useless work.
// Skip calling the comparator if the sub-list is already sorted.
if (mid >= end || comparefn(list[mid], list[mid + 1]) <= 0) {
if (mid >= end || callContentFunction(comparefn, undefined,
list[mid], list[mid + 1]) <= 0) {
for (var i = start; i <= end; i++) {
out[i] = list[i];
}
@ -142,7 +144,7 @@ function MergeTypedArray(list, out, start, mid, end, comparefn) {
while (i <= mid && j <= end) {
var lvalue = list[i];
var rvalue = list[j];
if (comparefn(lvalue, rvalue) <= 0) {
if (callContentFunction(comparefn, undefined, lvalue, rvalue) <= 0) {
out[k++] = lvalue;
i++;
} else {

16
js/src/builtin/TypedArray.js
Просмотреть файл

@ -129,7 +129,8 @@ function ValidateTypedArray(obj) {
// 22.2.4.6 TypedArrayCreate ( constructor, argumentList )
function TypedArrayCreateWithLength(constructor, length) {
// Step 1.
var newTypedArray = new constructor(length);
var newTypedArray = constructContentFunction(constructor, constructor,
length);
// Step 2.
var isTypedArray = ValidateTypedArray(newTypedArray);
@ -154,7 +155,8 @@ function TypedArrayCreateWithLength(constructor, length) {
// 22.2.4.6 TypedArrayCreate ( constructor, argumentList )
function TypedArrayCreateWithBuffer(constructor, buffer, byteOffset, length) {
// Step 1.
var newTypedArray = new constructor(buffer, byteOffset, length);
var newTypedArray = constructContentFunction(constructor, constructor,
buffer, byteOffset, length);
// Step 2.
ValidateTypedArray(newTypedArray);
@ -1023,7 +1025,7 @@ function TypedArraySort(comparefn) {
// the user supplied comparefn is wrapped.
var wrappedCompareFn = function(x, y) {
// Step a.
var v = +comparefn(x, y);
var v = +callContentFunction(comparefn, undefined, x, y);
// Step b.
if (v !== v)
@ -1412,7 +1414,7 @@ function TypedArrayStaticFrom(source, mapfn = undefined, thisArg = undefined) {
var len = TypedArrayLength(source);
// Step 7.c.
var targetObj = new C(len);
var targetObj = constructContentFunction(C, C, len);
// Steps 7.d-f.
for (var k = 0; k < len; k++) {
@ -1428,7 +1430,7 @@ function TypedArrayStaticFrom(source, mapfn = undefined, thisArg = undefined) {
ArrayIteratorPrototypeOptimizable())
{
// Steps 7.b-c.
var targetObj = new C(source.length);
var targetObj = constructContentFunction(C, C, source.length);
// Steps 7.a, 7.d-f.
TypedArrayInitFromPackedArray(targetObj, source);
@ -1610,7 +1612,7 @@ function ArrayBufferSlice(start, end) {
var ctor = SpeciesConstructor(O, GetBuiltinConstructor("ArrayBuffer"));
// Step 12.
var new_ = new ctor(newLen);
var new_ = constructContentFunction(ctor, ctor, newLen);
// Steps 13-15.
var isWrapped = false;
@ -1708,7 +1710,7 @@ function SharedArrayBufferSlice(start, end) {
var ctor = SpeciesConstructor(O, GetBuiltinConstructor("SharedArrayBuffer"));
// Step 11.
var new_ = new ctor(newLen);
var new_ = constructContentFunction(ctor, ctor, newLen);
// Steps 12-13.
var isWrapped = false;