Fix bad assert in StructureRareData::setObjectToStringValue
https://bugs.webkit.org/show_bug.cgi?id=159171
<rdar://problem/26987355>
Reviewed by Mark Lam.
We should not have expected the generateConditionsForPrototypePropertyHit would succeed.
There are many reasons it might fail including that there is a proxy somewhere on the
prototype chain of the object.
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::setObjectToStringValue):
* tests/stress/object-toString-with-proxy.js: Added.
(get target):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@202528 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/tests/stress/object-toString-with-proxy.js b/Source/JavaScriptCore/tests/stress/object-toString-with-proxy.js
new file mode 100644
index 0000000..855ee5e
--- /dev/null
+++ b/Source/JavaScriptCore/tests/stress/object-toString-with-proxy.js
@@ -0,0 +1,27 @@
+let foo = {};
+let properties = [];
+let p = new Proxy(foo, { get:(target, property) => {
+ properties.push(property.toString());
+ if (property === Symbol.toStringTag)
+ return "bad things";
+ return target[property];
+}});
+
+for (i = 0; i < 5; i++) {
+ if (p != "[object bad things]")
+ throw new Error("bad toString result.");
+
+ if (properties[0] !== "Symbol(Symbol.toPrimitive)" || properties[1] !== "valueOf" || properties[2] !== "toString" || properties[3] !== "Symbol(Symbol.toStringTag)")
+ throw new Error("bad property accesses.");
+
+ properties = [];
+}
+
+p = createProxy(foo);
+
+for (i = 0; i < 5; i++) {
+ let str = "bad things" + i;
+ foo[Symbol.toStringTag] = str;
+ if (p != "[object " + str + "]")
+ throw new Error("bad toString result.");
+}
