Bug 1322319 - Check the result of GetGetterPure. r=h4writer
authorTooru Fujisawa <arai_a@mac.com>
Sat, 10 Dec 2016 03:42:16 +0900
changeset 325599 c9d3669dc5133a29944acb1353101c7bf905e914
parent 325598 1cce3b69bfc76377f5a0c015372d790b81f7b2bd
child 325600 66ade78caf23bec157af20279a0e9ea6c93901e8
push id24
push usermaklebus@msu.edu
push dateTue, 20 Dec 2016 03:11:33 +0000
reviewersh4writer
bugs1322319
milestone53.0a1
Bug 1322319 - Check the result of GetGetterPure. r=h4writer
js/src/builtin/RegExp.cpp
js/src/tests/ecma_6/RegExp/split-deleted-flags.js
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -1603,16 +1603,21 @@ js::RegExpPrototypeOptimizableRaw(JSCont
         *result = true;
         return true;
     }
 
     JSFunction* flagsGetter;
     if (!GetGetterPure(cx, proto, NameToId(cx->names().flags), &flagsGetter))
         return false;
 
+    if (!flagsGetter) {
+        *result = false;
+        return true;
+    }
+
     if (!IsSelfHostedFunctionWithName(flagsGetter, cx->names().RegExpFlagsGetter)) {
         *result = false;
         return true;
     }
 
     JSNative globalGetter;
     if (!GetOwnNativeGetterPure(cx, proto, NameToId(cx->names().global), &globalGetter))
         return false;
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/split-deleted-flags.js
@@ -0,0 +1,11 @@
+var BUGNUMBER = 1322319;
+var summary = "RegExp.prototype.split should throw if RegRxp.prototype.flags is deleted."
+
+print(BUGNUMBER + ": " + summary);
+
+delete RegExp.prototype.flags;
+
+assertThrowsInstanceOf(() => "aaaaa".split(/a/), SyntaxError);
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);