Title: [226305] trunk
- Revision
- 226305
- Author
- sbar...@apple.com
- Date
- 2017-12-28 10:13:15 -0800 (Thu, 28 Dec 2017)
Log Message
Assertion used to determine if something is an async generator is wrong
https://bugs.webkit.org/show_bug.cgi?id=181168
<rdar://problem/35640560>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/async-generator-assertion.js: Added.
Source/_javascript_Core:
Previous assertions were doing a get on the base value for @@asyncIterator.
This symbol is defined on AsyncGeneratorPrototype. The base value may change
its prototype, but it's still an async generator as far as our system is
concerned. This patch updates the assertion to check for a private property
on the base value.
* builtins/AsyncGeneratorPrototype.js:
(globalPrivate.asyncGeneratorReject):
(globalPrivate.asyncGeneratorResolve):
(globalPrivate.asyncGeneratorResumeNext):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (226304 => 226305)
--- trunk/JSTests/ChangeLog 2017-12-28 14:17:06 UTC (rev 226304)
+++ trunk/JSTests/ChangeLog 2017-12-28 18:13:15 UTC (rev 226305)
@@ -1,3 +1,13 @@
+2017-12-28 Saam Barati <sbar...@apple.com>
+
+ Assertion used to determine if something is an async generator is wrong
+ https://bugs.webkit.org/show_bug.cgi?id=181168
+ <rdar://problem/35640560>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/async-generator-assertion.js: Added.
+
2017-12-21 Guillaume Emont <guijem...@igalia.com>
Skip stress/splay-flash-access tests on memory limited platforms
Added: trunk/JSTests/stress/async-generator-assertion.js (0 => 226305)
--- trunk/JSTests/stress/async-generator-assertion.js (rev 0)
+++ trunk/JSTests/stress/async-generator-assertion.js 2017-12-28 18:13:15 UTC (rev 226305)
@@ -0,0 +1,36 @@
+function assert(b) {
+ if (!b)
+ throw new Error("Bad");
+}
+
+async function* asyncIterator() {
+ yield 42;
+}
+
+function test1() {
+ let p = asyncIterator();
+ p.next().then((x) => {
+ assert(x.value === 42);
+ assert(x.done === false);
+ });
+ p.__proto__ = {};
+ assert(p.next === undefined);
+}
+test1();
+
+let error = null;
+async function test2() {
+ let p2 = asyncIterator();
+ p2.__proto__ = {};
+ try {
+ for await (let x of p2) {
+ throw new Error("Bad!");
+ }
+ }
+ catch(e) {
+ error = e;
+ }
+}
+test2();
+assert(error instanceof TypeError);
+assert(error.message === "undefined is not a function (near '...x of p2...')");
Modified: trunk/Source/_javascript_Core/ChangeLog (226304 => 226305)
--- trunk/Source/_javascript_Core/ChangeLog 2017-12-28 14:17:06 UTC (rev 226304)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-12-28 18:13:15 UTC (rev 226305)
@@ -1,3 +1,22 @@
+2017-12-28 Saam Barati <sbar...@apple.com>
+
+ Assertion used to determine if something is an async generator is wrong
+ https://bugs.webkit.org/show_bug.cgi?id=181168
+ <rdar://problem/35640560>
+
+ Reviewed by Yusuke Suzuki.
+
+ Previous assertions were doing a get on the base value for @@asyncIterator.
+ This symbol is defined on AsyncGeneratorPrototype. The base value may change
+ its prototype, but it's still an async generator as far as our system is
+ concerned. This patch updates the assertion to check for a private property
+ on the base value.
+
+ * builtins/AsyncGeneratorPrototype.js:
+ (globalPrivate.asyncGeneratorReject):
+ (globalPrivate.asyncGeneratorResolve):
+ (globalPrivate.asyncGeneratorResumeNext):
+
2017-12-27 Carlos Alberto Lopez Perez <clo...@igalia.com>
Build fix after r226299 (3)
Modified: trunk/Source/_javascript_Core/builtins/AsyncGeneratorPrototype.js (226304 => 226305)
--- trunk/Source/_javascript_Core/builtins/AsyncGeneratorPrototype.js 2017-12-28 14:17:06 UTC (rev 226304)
+++ trunk/Source/_javascript_Core/builtins/AsyncGeneratorPrototype.js 2017-12-28 18:13:15 UTC (rev 226305)
@@ -103,7 +103,7 @@
{
"use strict";
- @assert(generator.@asyncIteratorSymbol !== @undefined, "Generator is not an AsyncGenerator instance.");
+ @assert(typeof generator.@asyncGeneratorSuspendReason === "number", "Generator is not an AsyncGenerator instance.");
const { promiseCapability } = @asyncGeneratorDequeue(generator);
promiseCapability.@reject.@call(@undefined, exception);
@@ -116,7 +116,7 @@
{
"use strict";
- @assert(generator.@asyncIteratorSymbol !== @undefined, "Generator is not an AsyncGenerator instance.");
+ @assert(typeof generator.@asyncGeneratorSuspendReason === "number", "Generator is not an AsyncGenerator instance.");
const { promiseCapability } = @asyncGeneratorDequeue(generator);
promiseCapability.@resolve.@call(@undefined, { done, value: value });
@@ -203,7 +203,7 @@
{
"use strict";
- @assert(generator.@asyncIteratorSymbol !== @undefined, "Generator is not an AsyncGenerator instance");
+ @assert(typeof generator.@asyncGeneratorSuspendReason === "number", "Generator is not an AsyncGenerator instance.");
let state = generator.@generatorState;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
