mirror of
https://github.com/RGBCube/serenity
synced 2025-10-24 14:42:36 +00:00
00b8ce4a6d
The existing code looks innocently correct, implementing the following
step:
3. If IsCallable(func) is false, set func to the intrinsic function
%Object.prototype.toString%.
as
return ObjectPrototype::to_string(vm, global_object);
However, this misses the fact that the next step calls the function with
the previously ToObject()'d this value (`array`):
4. Return ? Call(func, array).
This doesn't happen in the current implementation, which will use the
unaltered this value from the Array.prototype.toString() call, and make
another, unequal object in %Object.prototype.toString%. Since both that
and Array.prototype.toString() do a Get() call on said object, this
behavior is observable (see newly added test).
Fix this by actually doing what the spec says and calling the fallback
function the regular way.
|
||
|---|---|---|
| .. | ||
| array-basic.js | ||
| array-index-from-string.js | ||
| array-length-setter.js | ||
| array-shrink-during-find-crash.js | ||
| array-simple-and-generic-storage-initialization.js | ||
| array-spread.js | ||
| Array.from.js | ||
| Array.isArray.js | ||
| Array.js | ||
| Array.of.js | ||
| Array.prototype-generic-functions.js | ||
| Array.prototype.at.js | ||
| Array.prototype.concat.js | ||
| Array.prototype.copyWithin.js | ||
| Array.prototype.entries.js | ||
| Array.prototype.every.js | ||
| Array.prototype.fill.js | ||
| Array.prototype.filter.js | ||
| Array.prototype.find.js | ||
| Array.prototype.findIndex.js | ||
| Array.prototype.findLast.js | ||
| Array.prototype.findLastIndex.js | ||
| Array.prototype.flat.js | ||
| Array.prototype.flatMap.js | ||
| Array.prototype.forEach.js | ||
| Array.prototype.groupBy.js | ||
| Array.prototype.groupByToMap.js | ||
| Array.prototype.includes.js | ||
| Array.prototype.indexOf.js | ||
| Array.prototype.join.js | ||
| Array.prototype.keys.js | ||
| Array.prototype.lastIndexOf.js | ||
| Array.prototype.map.js | ||
| Array.prototype.pop.js | ||
| Array.prototype.push.js | ||
| Array.prototype.reduce.js | ||
| Array.prototype.reduceRight.js | ||
| Array.prototype.reverse.js | ||
| Array.prototype.shift.js | ||
| Array.prototype.slice.js | ||
| Array.prototype.some.js | ||
| Array.prototype.sort.js | ||
| Array.prototype.splice.js | ||
| Array.prototype.toLocaleString.js | ||
| Array.prototype.toString.js | ||
| Array.prototype.unshift.js | ||
| Array.prototype.values.js | ||