tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

prop-expr-getsuperbase-before-topropertykey-putvalue-increment.js (1450B)


      1 // Copyright (C) 2024 André Bargull. All rights reserved.
      2 // This code is governed by the BSD license found in the LICENSE file.
      3 
      4 /*---
      5 esid: sec-super-keyword-runtime-semantics-evaluation
      6 description: >
      7  GetSuperBase is performed before ToPropertyKey in PutValue with increment operator.
      8 info: |
      9  13.3.7.1 Runtime Semantics: Evaluation
     10 
     11    SuperProperty : super [ Expression ]
     12 
     13    ...
     14    2. Let actualThis be ? env.GetThisBinding().
     15    3. Let propertyNameReference be ? Evaluation of Expression.
     16    4. Let propertyNameValue be ? GetValue(propertyNameReference).
     17    ...
     18    7. Return ? MakeSuperPropertyReference(actualThis, propertyNameValue, strict).
     19 
     20  13.3.7.3 MakeSuperPropertyReference ( actualThis, propertyKey, strict )
     21 
     22    1. Let env be GetThisEnvironment().
     23    ...
     24    3. Let baseValue be ? env.GetSuperBase().
     25    ...
     26 
     27  6.2.5.6 PutValue ( V, W )
     28 
     29    3. If IsPropertyReference(V) is true, then
     30      ...
     31      c. If V.[[ReferencedName]] is not a property key, then
     32          i. Set V.[[ReferencedName]] to ? ToPropertyKey(V.[[ReferencedName]]).
     33      d. Let succeeded be ? baseObj.[[Set]](V.[[ReferencedName]], W, GetThisValue(V)).
     34      ...
     35    ...
     36 ---*/
     37 
     38 var proto = {
     39  p: 1,
     40 };
     41 
     42 var proto2 = {
     43  p: -1,
     44 };
     45 
     46 var obj = {
     47  __proto__: proto,
     48  m() {
     49    return ++super[key];
     50  }
     51 };
     52 
     53 var key = {
     54  toString() {
     55    Object.setPrototypeOf(obj, proto2);
     56    return "p";
     57  }
     58 };
     59 
     60 assert.sameValue(obj.m(), 2);
     61 
     62 reportCompare(0, 0);