Bug 1199422 - Stop pattern matching class-constructors in String#replace and Array#sort. r=efaust

This commit is contained in:
Tom Schuster 2015-12-04 22:41:04 +01:00
parent a10e6c590b
commit a06bb506b3
3 changed files with 36 additions and 2 deletions

View File

@ -1653,7 +1653,7 @@ MatchNumericComparator(JSContext* cx, const Value& v)
return Match_None;
JSFunction* fun = &obj.as<JSFunction>();
if (!fun->isInterpreted())
if (!fun->isInterpreted() || fun->isClassConstructor())
return Match_None;
JSScript* script = fun->getOrCreateScript(cx);

View File

@ -3485,7 +3485,7 @@ LambdaIsGetElem(JSContext* cx, JSObject& lambda, MutableHandleNativeObject pobj)
return true;
RootedFunction fun(cx, &lambda.as<JSFunction>());
if (!fun->isInterpreted())
if (!fun->isInterpreted() || fun->isClassConstructor())
return true;
JSScript* script = fun->getOrCreateScript(cx);

View File

@ -0,0 +1,34 @@
// Constructors can't be called so we can't pattern match
// them in replace and sort.
var test = `
function a() {
var b = {a: "A"};
class X {
constructor(a) {
return b[a]
}
};
assertThrowsInstanceOf(() => "a".replace(/a/, X), TypeError);
}
function b() {
class X {
constructor(x, y) {
return x - y;
}
}
assertThrowsInstanceOf(() => [1, 2, 3].sort(X), TypeError);
}
a();
b();
`;
if (classesEnabled())
eval(test);
if (typeof reportCompare === "function")
reportCompare(0, 0, "OK");