From fe7e906f4aed27e8ba0155620737e8ce67860ab8 Mon Sep 17 00:00:00 2001
From: Rick Waldron <waldron.rick@gmail.com>
Date: Fri, 11 Aug 2017 12:18:06 -0400
Subject: [PATCH] Proxy ownKeys should throw a TypeError if returned keys are
 not String or Symbol. Fixes gh-1169 (#1173)

---
 .../Proxy/ownKeys/return-type-throws-array.js | 34 +++++++++++++++++++
 .../ownKeys/return-type-throws-boolean.js     | 34 +++++++++++++++++++
 .../Proxy/ownKeys/return-type-throws-null.js  | 34 +++++++++++++++++++
 .../ownKeys/return-type-throws-number.js      | 34 +++++++++++++++++++
 .../ownKeys/return-type-throws-object.js      | 34 +++++++++++++++++++
 .../ownKeys/return-type-throws-undefined.js   | 34 +++++++++++++++++++
 6 files changed, 204 insertions(+)
 create mode 100644 test/built-ins/Proxy/ownKeys/return-type-throws-array.js
 create mode 100644 test/built-ins/Proxy/ownKeys/return-type-throws-boolean.js
 create mode 100644 test/built-ins/Proxy/ownKeys/return-type-throws-null.js
 create mode 100644 test/built-ins/Proxy/ownKeys/return-type-throws-number.js
 create mode 100644 test/built-ins/Proxy/ownKeys/return-type-throws-object.js
 create mode 100644 test/built-ins/Proxy/ownKeys/return-type-throws-undefined.js

diff --git a/test/built-ins/Proxy/ownKeys/return-type-throws-array.js b/test/built-ins/Proxy/ownKeys/return-type-throws-array.js
new file mode 100644
index 0000000000..1088f8e290
--- /dev/null
+++ b/test/built-ins/Proxy/ownKeys/return-type-throws-array.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+description: >
+    The returned list must not have entries whose type does not match
+    « String, Symbol ».
+info: >
+    [[OwnPropertyKeys]] ( )
+
+    ...
+    7. Let trapResultArray be ? Call(trap, handler, « target »).
+    8. Let trapResult be ?
+        CreateListFromArrayLike(trapResultArray, « String, Symbol »).
+    ...
+
+    CreateListFromArrayLike ( obj [ , elementTypes ] )
+
+    ...
+    6. Repeat, while index < len
+      ...
+      d. If Type(next) is not an element of elementTypes,
+          throw a TypeError exception.
+---*/
+
+var p = new Proxy({}, {
+  ownKeys() {
+    return [[]];
+  }
+});
+
+assert.throws(TypeError, function() {
+  Object.keys(p);
+});
diff --git a/test/built-ins/Proxy/ownKeys/return-type-throws-boolean.js b/test/built-ins/Proxy/ownKeys/return-type-throws-boolean.js
new file mode 100644
index 0000000000..e97209fe9f
--- /dev/null
+++ b/test/built-ins/Proxy/ownKeys/return-type-throws-boolean.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+description: >
+    The returned list must not have entries whose type does not match
+    « String, Symbol ».
+info: >
+    [[OwnPropertyKeys]] ( )
+
+    ...
+    7. Let trapResultArray be ? Call(trap, handler, « target »).
+    8. Let trapResult be ?
+        CreateListFromArrayLike(trapResultArray, « String, Symbol »).
+    ...
+
+    CreateListFromArrayLike ( obj [ , elementTypes ] )
+
+    ...
+    6. Repeat, while index < len
+      ...
+      d. If Type(next) is not an element of elementTypes,
+          throw a TypeError exception.
+---*/
+
+var p = new Proxy({}, {
+  ownKeys() {
+    return [true];
+  }
+});
+
+assert.throws(TypeError, function() {
+  Object.keys(p);
+});
diff --git a/test/built-ins/Proxy/ownKeys/return-type-throws-null.js b/test/built-ins/Proxy/ownKeys/return-type-throws-null.js
new file mode 100644
index 0000000000..8b464e837c
--- /dev/null
+++ b/test/built-ins/Proxy/ownKeys/return-type-throws-null.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+description: >
+    The returned list must not have entries whose type does not match
+    « String, Symbol ».
+info: >
+    [[OwnPropertyKeys]] ( )
+
+    ...
+    7. Let trapResultArray be ? Call(trap, handler, « target »).
+    8. Let trapResult be ?
+        CreateListFromArrayLike(trapResultArray, « String, Symbol »).
+    ...
+
+    CreateListFromArrayLike ( obj [ , elementTypes ] )
+
+    ...
+    6. Repeat, while index < len
+      ...
+      d. If Type(next) is not an element of elementTypes,
+          throw a TypeError exception.
+---*/
+
+var p = new Proxy({}, {
+  ownKeys() {
+    return [null];
+  }
+});
+
+assert.throws(TypeError, function() {
+  Object.keys(p);
+});
diff --git a/test/built-ins/Proxy/ownKeys/return-type-throws-number.js b/test/built-ins/Proxy/ownKeys/return-type-throws-number.js
new file mode 100644
index 0000000000..0ab76341d7
--- /dev/null
+++ b/test/built-ins/Proxy/ownKeys/return-type-throws-number.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+description: >
+    The returned list must not have entries whose type does not match
+    « String, Symbol ».
+info: >
+    [[OwnPropertyKeys]] ( )
+
+    ...
+    7. Let trapResultArray be ? Call(trap, handler, « target »).
+    8. Let trapResult be ?
+        CreateListFromArrayLike(trapResultArray, « String, Symbol »).
+    ...
+
+    CreateListFromArrayLike ( obj [ , elementTypes ] )
+
+    ...
+    6. Repeat, while index < len
+      ...
+      d. If Type(next) is not an element of elementTypes,
+          throw a TypeError exception.
+---*/
+
+var p = new Proxy({}, {
+  ownKeys() {
+    return [1];
+  }
+});
+
+assert.throws(TypeError, function() {
+  Object.keys(p);
+});
diff --git a/test/built-ins/Proxy/ownKeys/return-type-throws-object.js b/test/built-ins/Proxy/ownKeys/return-type-throws-object.js
new file mode 100644
index 0000000000..433157e054
--- /dev/null
+++ b/test/built-ins/Proxy/ownKeys/return-type-throws-object.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+description: >
+    The returned list must not have entries whose type does not match
+    « String, Symbol ».
+info: >
+    [[OwnPropertyKeys]] ( )
+
+    ...
+    7. Let trapResultArray be ? Call(trap, handler, « target »).
+    8. Let trapResult be ?
+        CreateListFromArrayLike(trapResultArray, « String, Symbol »).
+    ...
+
+    CreateListFromArrayLike ( obj [ , elementTypes ] )
+
+    ...
+    6. Repeat, while index < len
+      ...
+      d. If Type(next) is not an element of elementTypes,
+          throw a TypeError exception.
+---*/
+
+var p = new Proxy({}, {
+  ownKeys() {
+    return [{}];
+  }
+});
+
+assert.throws(TypeError, function() {
+  Object.keys(p);
+});
diff --git a/test/built-ins/Proxy/ownKeys/return-type-throws-undefined.js b/test/built-ins/Proxy/ownKeys/return-type-throws-undefined.js
new file mode 100644
index 0000000000..9800fa4dfa
--- /dev/null
+++ b/test/built-ins/Proxy/ownKeys/return-type-throws-undefined.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+description: >
+    The returned list must not have entries whose type does not match
+    « String, Symbol ».
+info: >
+    [[OwnPropertyKeys]] ( )
+
+    ...
+    7. Let trapResultArray be ? Call(trap, handler, « target »).
+    8. Let trapResult be ?
+        CreateListFromArrayLike(trapResultArray, « String, Symbol »).
+    ...
+
+    CreateListFromArrayLike ( obj [ , elementTypes ] )
+
+    ...
+    6. Repeat, while index < len
+      ...
+      d. If Type(next) is not an element of elementTypes,
+          throw a TypeError exception.
+---*/
+
+var p = new Proxy({}, {
+  ownKeys() {
+    return [undefined];
+  }
+});
+
+assert.throws(TypeError, function() {
+  Object.keys(p);
+});
-- 
GitLab