mirror of
https://github.com/RGBCube/serenity
synced 2025-05-31 12:28:12 +00:00
00b8ce4a6d
The existing code looks innocently correct, implementing the following
step:
3. If IsCallable(func) is false, set func to the intrinsic function
%Object.prototype.toString%.
as
return ObjectPrototype::to_string(vm, global_object);
However, this misses the fact that the next step calls the function with
the previously ToObject()'d this value (`array`):
4. Return ? Call(func, array).
This doesn't happen in the current implementation, which will use the
unaltered this value from the Array.prototype.toString() call, and make
another, unequal object in %Object.prototype.toString%. Since both that
and Array.prototype.toString() do a Get() call on said object, this
behavior is observable (see newly added test).
Fix this by actually doing what the spec says and calling the fallback
function the regular way.
|
||
|---|---|---|
| .. | ||
| builtins | ||
| classes | ||
| functions | ||
| iterators | ||
| loops | ||
| modules | ||
| operators | ||
| syntax | ||
| add-values-to-primitive.js | ||
| arguments-callee.js | ||
| arguments-object.js | ||
| automatic-semicolon-insertion.js | ||
| break-continue-syntax-errors.js | ||
| comments-basic.js | ||
| computed-property-sideeffects.js | ||
| computed-property-throws.js | ||
| const-declaration-missing-initializer.js | ||
| const-reassignment.js | ||
| custom-@@hasInstance.js | ||
| custom-@@toPrimitive.js | ||
| custom-@@toStringTag.js | ||
| debugger-statement.js | ||
| duplicated-variable-declarations.js | ||
| empty-statements.js | ||
| eval-aliasing.js | ||
| eval-basic.js | ||
| exception-in-catch-block.js | ||
| exception-ReferenceError.js | ||
| exponentiation-basic.js | ||
| global-var-let-const.js | ||
| if-statement-function-declaration.js | ||
| indexed-access-prototype-indirection.js | ||
| indexed-access-string-object.js | ||
| invalid-lhs-in-assignment.js | ||
| labels.js | ||
| let-scoping.js | ||
| new-expression.js | ||
| non-writable-assignment.js | ||
| numeric-literals-basic.js | ||
| object-basic.js | ||
| object-expression-__proto__.js | ||
| object-expression-computed-property.js | ||
| object-expression-numeric-property.js | ||
| object-getter-setter-shorthand.js | ||
| object-method-shorthand.js | ||
| object-spread.js | ||
| ordinary-to-primitive.js | ||
| parseInt.js | ||
| parser-declaration-in-single-statement-context.js | ||
| parser-line-terminators.js | ||
| parser-unary-associativity.js | ||
| permanently-screwed-by-eval.js | ||
| program-non-strict.js | ||
| program-strict-mode.js | ||
| return.js | ||
| runtime-error-call-stack-size.js | ||
| statement-with-many-labels.js | ||
| strict-mode-blocks.js | ||
| strict-mode-errors.js | ||
| string-basic.js | ||
| string-concatenation.js | ||
| string-escapes.js | ||
| string-spread.js | ||
| switch-basic.js | ||
| switch-break.js | ||
| switch-default-before-case.js | ||
| tagged-template-literals.js | ||
| template-literals.js | ||
| test-common-tests.js | ||
| test-common.js | ||
| this-value-strict.js | ||
| this-value.js | ||
| throw-basic.js | ||
| to-number-basic.js | ||
| to-number-exception.js | ||
| try-catch-finally-nested.js | ||
| try-catch-finally-return.js | ||
| try-catch-finally.js | ||
| unicode-identifier-escape.js | ||
| update-expression-on-member-expression.js | ||
| update-expressions-basic.js | ||
| use-strict-directive.js | ||
| var-multiple-declarator.js | ||
| var-scoping.js | ||
| variable-undefined.js | ||
| with-basic.js | ||