[GR-32016] Correction of Object/Array.prototype.toString(proxyObject).

PullRequest: js/2033

Author: iamstolis

graal-js/src/com.oracle.truffle.js.test/js/GR-32016.js

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2021, 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
+ */
+
+/**
+ * Tests of Object/Array.prototype.toString on proxy objects.
+ */
+
+load('assert.js');
+
+// Ensure that Array.prototype.toString invokes Object.prototype.toString
+delete Array.prototype.join;
+
+[Object.prototype.toString, Array.prototype.toString].forEach(function (testedFunction) {
+    // Proxy does not inherit [[ParameterMap]], [[ErrorData]], [[BooleanData]],
+    // [[NumberData]], [[StringData]], [[DateValue]] and [[RegExpMatcher]] internal slots
+    var argumentsObject = (function() { return arguments; })();
+    assertSame('[object Object]', testedFunction.call(new Proxy(argumentsObject, {})));
+    assertSame('[object Object]', testedFunction.call(new Proxy(new Error(), {})));
+    assertSame('[object Object]', testedFunction.call(new Proxy(Object(true), {})));
+    assertSame('[object Object]', testedFunction.call(new Proxy(Object(42), {})));
+    assertSame('[object Object]', testedFunction.call(new Proxy(Object('foo'), {})));
+    assertSame('[object Object]', testedFunction.call(new Proxy(new Date(), {})));
+    assertSame('[object Object]', testedFunction.call(new Proxy(/a/, {})));
+
+    // Proxy inherits [[Call]] internal slot
+    assertSame('[object Function]', testedFunction.call(new Proxy(function() {}, {})));
+
+    // There is an explicit handling of array Proxy targets in Object.prototype.toString
+    assertSame('[object Array]', testedFunction.call(new Proxy([], {})));
+    // revoked
+    var revocable = Proxy.revocable([], {});
+    revocable.revoke();
+    assertThrows(function() {
+        testedFunction.call(revocable.proxy);
+    }, TypeError);
+    // revoked too late (after builtinTag was determined)
+    revocable = Proxy.revocable([], {
+        get: function (target, key, receiver) {
+            if (key === Symbol.toStringTag) {
+                revocable.revoke();
+                return undefined;
+            } else {
+                return Reflect.get(target, key, receiver);
+            }
+        },
+    });
+    assertSame('[object Array]', testedFunction.call(revocable.proxy));    
+});

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/builtins/ObjectPrototypeBuiltins.java

@@ -85,7 +85,6 @@
 import com.oracle.truffle.js.runtime.builtins.BuiltinEnum;
 import com.oracle.truffle.js.runtime.builtins.JSClass;
 import com.oracle.truffle.js.runtime.builtins.JSOrdinary;
-import com.oracle.truffle.js.runtime.builtins.JSProxy;
 import com.oracle.truffle.js.runtime.objects.JSLazyString;
 import com.oracle.truffle.js.runtime.objects.JSObject;
 import com.oracle.truffle.js.runtime.objects.Null;
@@ -309,12 +308,13 @@ protected String doJSObject(DynamicObject thisObj,
         @Specialization(guards = "isJSProxy(thisObj)")
         protected String doJSProxy(DynamicObject thisObj,
                         @Shared("builtinTag") @Cached("create()") GetBuiltinToStringTagNode getBuiltinToStringTagNode) {
-            Object target = JSProxy.getTargetNonProxy(thisObj);
-            String toString = getToStringTag(thisObj);
-            if (toString == null) {
-                toString = getBuiltinToStringTagNode.execute(target);
+            // builtinTag must be read before tag because the latter may revoke the proxy
+            String builtinTag = getBuiltinToStringTagNode.execute(thisObj);
+            String tag = getToStringTag(thisObj);
+            if (tag == null) {
+                tag = builtinTag;
             }
-            return formatString(toString);
+            return formatString(tag);
         }
 
         @Specialization(guards = "isJSNull(thisObj)")

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/builtins/JSClass.java

@@ -244,16 +244,13 @@ public String defaultToString(DynamicObject object) {
     }
 
     protected String getToStringTag(DynamicObject object) {
-        String result = null;
+        String result = getBuiltinToStringTag(object);
         if (JSRuntime.isObject(object)) {
             Object toStringTag = JSObject.get(object, Symbol.SYMBOL_TO_STRING_TAG);
             if (JSRuntime.isString(toStringTag)) {
                 result = JSRuntime.toStringIsString(toStringTag);
             }
         }
-        if (result == null) {
-            result = getBuiltinToStringTag(object);
-        }
         return result;
     }
 

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/builtins/JSProxy.java

@@ -548,7 +548,13 @@ public boolean isExtensible(DynamicObject thisObj) {
     public String getBuiltinToStringTag(DynamicObject object) {
         Object targetNonProxy = getTargetNonProxy(object);
         if (JSDynamicObject.isJSDynamicObject(targetNonProxy)) {
-            return JSObject.getJSClass((DynamicObject) targetNonProxy).getBuiltinToStringTag((DynamicObject) targetNonProxy);
+            if (JSArray.isJSArray(targetNonProxy)) {
+                return JSArray.CLASS_NAME;
+            } else if (JSFunction.isJSFunction(targetNonProxy)) {
+                return JSFunction.CLASS_NAME;
+            } else {
+                return "Object";
+            }
         } else {
             return "Foreign";
         }

graal-js/test/test262.json

@@ -3,10 +3,6 @@
     "filePath" : "annexB/built-ins/RegExp/prototype/compile/this-cross-realm-instance.js",
     "status" : "FAIL",
     "comment" : "new failures 2020-11-23"
-  }, {
-    "filePath" : "built-ins/Array/prototype/toString/non-callable-join-string-tag.js",
-    "status" : "FAIL",
-    "comment" : "new failures 2021-05-27"
   }, {
     "filePath" : "built-ins/Atomics/wait/bigint/no-spurious-wakeup-no-operation.js",
     "status" : "PASS",