1355558 - Throw TypeError when calling RegExp flag and source getters with RegExp.prototype from different global

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[André Bargull [:anba]]

Test case:
---
var g = newGlobal();
var r = g.eval("RegExp.prototype");
Object.getOwnPropertyDescriptor(RegExp.prototype, "source").get.call(r);
---

Expected: Throws TypeError
Actual: No TypeError

https://tc39.github.io/ecma262/#sec-get-regexp.prototype.source
Step 3.a compares the this-value with the %RegExpPrototype% of the running execution context, so a wrapped RegExp.prototype object should throw per step 3.b.

Comment 1

[André Bargull [:anba]]

Attachment: bug1355558.patch

I've also removed some trivial unnecessary rooting.

Comment 2

[Tom S [:evilpie]]

This seems correct, but this is change might still cause regressions. Can you please push this to try?

Comment 3

[André Bargull [:anba]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=27ea2f4a02ee4f94213b42c73a45a4a9db9c03a6

Comment 4

[André Bargull [:anba]]

(In reply to Tom Schuster [:evilpie] from comment #2)
> This seems correct, but this is change might still cause regressions. Can
> you please push this to try?

Try looks good. 

Chrome is also throwing for cross-global RegExp.prototypes, so I hope this change is web-compatible. We'll see... :-)

Comment 5

[Tom S [:evilpie]]

Comment on attachment 8857470 [details] [diff] [review]
bug1355558.patch

Review of attachment 8857470 [details] [diff] [review]:
-----------------------------------------------------------------

Okay, you are probably right.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9dd3f067044f
Throw when calling RegExp.prototype getters with RegExp.prototype from different global. r=evilpie

Comment 7

[Iris Hsiao [:ihsiao]]

https://hg.mozilla.org/mozilla-central/rev/9dd3f067044f