From 2b19d1b5abfa66933e02d475de761d9a4d6ede63 Mon Sep 17 00:00:00 2001 From: Timothy Flynn Date: Thu, 6 Jul 2023 16:18:17 -0400 Subject: [PATCH] LibJS: Do not coerce nullish references to unresolvable references These are not strictly unresolvable references. Treating them as such fails an assertion in the `delete UnaryExpression` semantic (which is Reference::delete_ in our implementation) - we enter the unresolvable, branch, which then asserts that the [[Strict]] slot of the reference is false. --- Userland/Libraries/LibJS/Runtime/Reference.h | 6 ------ .../Libraries/LibJS/Tests/operators/delete-basic.js | 11 +++++++++++ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/Userland/Libraries/LibJS/Runtime/Reference.h b/Userland/Libraries/LibJS/Runtime/Reference.h index acf1672263..33f1ed8426 100644 --- a/Userland/Libraries/LibJS/Runtime/Reference.h +++ b/Userland/Libraries/LibJS/Runtime/Reference.h @@ -38,12 +38,6 @@ public: , m_this_value(this_value) , m_strict(strict) { - if (base.is_nullish()) { - m_base_type = BaseType::Unresolvable; - m_base_value = {}; - m_this_value = {}; - m_name = {}; - } } Reference(Environment& base, DeprecatedFlyString referenced_name, bool strict = false, Optional environment_coordinate = {}) diff --git a/Userland/Libraries/LibJS/Tests/operators/delete-basic.js b/Userland/Libraries/LibJS/Tests/operators/delete-basic.js index bbb1b58058..31fbfdb28a 100644 --- a/Userland/Libraries/LibJS/Tests/operators/delete-basic.js +++ b/Userland/Libraries/LibJS/Tests/operators/delete-basic.js @@ -87,6 +87,12 @@ test("deleting super property", () => { } } + class C { + static foo() { + delete super.bar; + } + } + const obj = new B(); expect(() => { obj.bar(); @@ -95,6 +101,11 @@ test("deleting super property", () => { expect(() => { obj.baz(); }).toThrowWithMessage(ReferenceError, "Can't delete a property on 'super'"); + + Object.setPrototypeOf(C, null); + expect(() => { + C.foo(); + }).toThrowWithMessage(ReferenceError, "Can't delete a property on 'super'"); }); test("deleting an object computed property coerces the object to a property key", () => {