From 6da621f161a8a7184f877b96df48b4c82c25fa7b Mon Sep 17 00:00:00 2001
From: Richard Gibson <richard.gibson@gmail.com>
Date: Tue, 30 Oct 2018 14:07:00 -0400
Subject: [PATCH] Assert error when invoking any %RegExpPrototype%-aware getter
 on cross-realm RegExp.prototype

---
 .../RegExp/prototype/dotAll/this-val-invalid-obj.js   | 11 +++++++++++
 .../RegExp/prototype/global/this-val-invalid-obj.js   | 11 +++++++++++
 .../prototype/ignoreCase/this-val-invalid-obj.js      | 11 +++++++++++
 .../prototype/multiline/this-val-invalid-obj.js       | 11 +++++++++++
 .../RegExp/prototype/sticky/this-val-invalid-obj.js   | 11 +++++++++++
 .../RegExp/prototype/unicode/this-val-invalid-obj.js  | 11 +++++++++++
 6 files changed, 66 insertions(+)

diff --git a/test/built-ins/RegExp/prototype/dotAll/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/dotAll/this-val-invalid-obj.js
index 0f0d3909b9..5790adcf4c 100644
--- a/test/built-ins/RegExp/prototype/dotAll/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/dotAll/this-val-invalid-obj.js
@@ -16,6 +16,9 @@ features: [regexp-dotall]
 ---*/
 
 var dotAll = Object.getOwnPropertyDescriptor(RegExp.prototype, 'dotAll').get;
+var other = $262.createRealm().global;
+var otherRegExpProto = other.RegExp.prototype;
+var otherRegExpGetter = Object.getOwnPropertyDescriptor(otherRegExpProto, 'dotAll').get;
 
 assert.throws(TypeError, function() {
   dotAll.call({});
@@ -28,3 +31,11 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   dotAll.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  dotAll.call(otherRegExpProto);
+}, 'cross-realm RegExp.prototype');
+
+assert.throws(other.TypeError, function() {
+  otherRegExpGetter.call(RegExp.prototype);
+}, 'cross-realm RegExp.prototype getter method against primary realm RegExp.prototype');
diff --git a/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js
index 123373d483..b8882b6250 100644
--- a/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js
@@ -13,6 +13,9 @@ info: |
 ---*/
 
 var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'global').get;
+var other = $262.createRealm().global;
+var otherRegExpProto = other.RegExp.prototype;
+var otherRegExpGetter = Object.getOwnPropertyDescriptor(otherRegExpProto, 'global').get;
 
 assert.throws(TypeError, function() {
   get.call({});
@@ -25,3 +28,11 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   get.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  get.call(otherRegExpProto);
+}, 'cross-realm RegExp.prototype');
+
+assert.throws(other.TypeError, function() {
+  otherRegExpGetter.call(RegExp.prototype);
+}, 'cross-realm RegExp.prototype getter method against primary realm RegExp.prototype');
diff --git a/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js
index b08d8e524b..d433ed3481 100644
--- a/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js
@@ -13,6 +13,9 @@ info: |
 ---*/
 
 var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'ignoreCase').get;
+var other = $262.createRealm().global;
+var otherRegExpProto = other.RegExp.prototype;
+var otherRegExpGetter = Object.getOwnPropertyDescriptor(otherRegExpProto, 'ignoreCase').get;
 
 assert.throws(TypeError, function() {
   get.call({});
@@ -25,3 +28,11 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   get.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  get.call(otherRegExpProto);
+}, 'cross-realm RegExp.prototype');
+
+assert.throws(other.TypeError, function() {
+  otherRegExpGetter.call(RegExp.prototype);
+}, 'cross-realm RegExp.prototype getter method against primary realm RegExp.prototype');
diff --git a/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js
index 85a8b78b87..e9178d1270 100644
--- a/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js
@@ -13,6 +13,9 @@ info: |
 ---*/
 
 var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'multiline').get;
+var other = $262.createRealm().global;
+var otherRegExpProto = other.RegExp.prototype;
+var otherRegExpGetter = Object.getOwnPropertyDescriptor(otherRegExpProto, 'multiline').get;
 
 assert.throws(TypeError, function() {
   get.call({});
@@ -25,3 +28,11 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   get.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  get.call(otherRegExpProto);
+}, 'cross-realm RegExp.prototype');
+
+assert.throws(other.TypeError, function() {
+  otherRegExpGetter.call(RegExp.prototype);
+}, 'cross-realm RegExp.prototype getter method against primary realm RegExp.prototype');
diff --git a/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js
index f982ecccf4..03c5fead85 100644
--- a/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js
@@ -14,6 +14,9 @@ info: |
 ---*/
 
 var sticky = Object.getOwnPropertyDescriptor(RegExp.prototype, 'sticky').get;
+var other = $262.createRealm().global;
+var otherRegExpProto = other.RegExp.prototype;
+var otherRegExpGetter = Object.getOwnPropertyDescriptor(otherRegExpProto, 'sticky').get;
 
 assert.throws(TypeError, function() {
   sticky.call({});
@@ -26,3 +29,11 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   sticky.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  sticky.call(otherRegExpProto);
+}, 'cross-realm RegExp.prototype');
+
+assert.throws(other.TypeError, function() {
+  otherRegExpGetter.call(RegExp.prototype);
+}, 'cross-realm RegExp.prototype getter method against primary realm RegExp.prototype');
diff --git a/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js
index 2c938a8852..7cd3dd0922 100644
--- a/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js
@@ -14,6 +14,9 @@ info: |
 ---*/
 
 var unicode = Object.getOwnPropertyDescriptor(RegExp.prototype, 'unicode').get;
+var other = $262.createRealm().global;
+var otherRegExpProto = other.RegExp.prototype;
+var otherRegExpGetter = Object.getOwnPropertyDescriptor(otherRegExpProto, 'unicode').get;
 
 assert.throws(TypeError, function() {
   unicode.call({});
@@ -26,3 +29,11 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   unicode.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  unicode.call(otherRegExpProto);
+}, 'cross-realm RegExp.prototype');
+
+assert.throws(other.TypeError, function() {
+  otherRegExpGetter.call(RegExp.prototype);
+}, 'cross-realm RegExp.prototype getter method against primary realm RegExp.prototype');
-- 
GitLab