Add a "type" getter to UnderlyingSourceBase

Because UnderlyingSourceBase did not have a "type" getter the type was inherited from Object.prototype, causing a crash when that returned something other than "undefined". BUG=806644 Change-Id: I709dc0469396e350f9494f102398a6d5bb5ff8d5 Reviewed-on: https://chromium-review.googlesource.com/936825 Commit-Queue: Adam Rice <ricea@chromium.org> Reviewed-by: Takeshi Yoshino <tyoshino@chromium.org> Cr-Commit-Position: refs/heads/master@{#539436}

Add a "type" getter to UnderlyingSourceBase
Because UnderlyingSourceBase did not have a "type" getter the type was inherited from Object.prototype, causing a crash when that returned something other than "undefined". BUG=806644 Change-Id: I709dc0469396e350f9494f102398a6d5bb5ff8d5 Reviewed-on: https://chromium-review.googlesource.com/936825 Commit-Queue: Adam Rice <ricea@chromium.org> Reviewed-by: Takeshi Yoshino <tyoshino@chromium.org> Cr-Commit-Position: refs/heads/master@{#539436}
05bb153b · Adam Rice · Commit Bot · 987b6648 · 05bb153b · 05bb153b
Commit 05bb153b authored Feb 27, 2018 by Adam Rice Committed by Commit Bot Feb 27, 2018
4 changed files
--- a/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/no-inherit-type.html
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/no-inherit-type.html
+<html>
+<title>Verify that a "type" attribute on Object.prototype is ignored</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+promise_test(async t => {
+  Object.prototype.type = 'incorrect';
+  t.add_cleanup(() => delete Object.prototype.type);
+  const response = await fetch('no-inherit-type.html');
+  const reader = response.body.getReader();
+  let done;
+  do {
+    done = (await reader.read()).done;
+  } while (!done);
+}, 'fetch() should work when Object.prototype.type is set');
+
+promise_test(async t => {
+  Object.defineProperty(Object.prototype, 'type', {
+    get: () => {
+      throw new Error('this should not have been called');
+    },
+    set: undefined
+  });
+  t.add_cleanup(() => delete Object.prototype.type);
+  const response = await fetch('no-inherit-type.html');
+  const reader = response.body.getReader();
+  let done;
+  do {
+    done = (await reader.read()).done;
+  } while (!done);
+}, 'fetch() should work when Object.prototype.type is a getter that throws');
+
+</script>
+</html>
+
--- a/third_party/WebKit/Source/core/streams/UnderlyingSourceBase.cpp
+++ b/third_party/WebKit/Source/core/streams/UnderlyingSourceBase.cpp
@@ -43,6 +43,10 @@ ScriptPromise UnderlyingSourceBase::Cancel(ScriptState* script_state,
  return ScriptPromise::CastUndefined(script_state);
 }

+ScriptValue UnderlyingSourceBase::type(ScriptState* script_state) const {
+  return ScriptValue(script_state, v8::Undefined(script_state->GetIsolate()));
+}
+
 void UnderlyingSourceBase::notifyLockAcquired() {
  is_stream_locked_ = true;
 }

--- a/third_party/WebKit/Source/core/streams/UnderlyingSourceBase.h
+++ b/third_party/WebKit/Source/core/streams/UnderlyingSourceBase.h
@@ -39,6 +39,8 @@ class CORE_EXPORT UnderlyingSourceBase
  ScriptPromise cancelWrapper(ScriptState*, ScriptValue reason);
  virtual ScriptPromise Cancel(ScriptState*, ScriptValue reason);

+  ScriptValue type(ScriptState*) const;
+
  void notifyLockAcquired();
  void notifyLockReleased();


--- a/third_party/WebKit/Source/core/streams/UnderlyingSourceBase.idl
+++ b/third_party/WebKit/Source/core/streams/UnderlyingSourceBase.idl
@@ -16,6 +16,9 @@ interface UnderlyingSourceBase {
    [CallWith=ScriptState] Promise<void> pull();
    [CallWith=ScriptState, ImplementedAs=cancelWrapper] Promise<void> cancel([Default=Undefined] optional any reason);

+    // This only exists to prevent Object.prototype.type being accessed.
+    [CallWith=ScriptState] readonly attribute any type;
+
    void notifyLockAcquired();
    void notifyLockReleased();
 };