Make a copy of String function in ReadableStream

The ReadableStream constructor uses the String function. However, the implementation was failing to take a copy of the function. This meant that the version from the Javascript environment was used. If it had been modified then it could result in incorrect behaviour. Use a copy of the original value of the String function in ReadableStream. This change also includes a regression test. BUG=752177 Change-Id: I52f36244a9d87131219958837e3cee00a8fc5fb4 Reviewed-on: https://chromium-review.googlesource.com/601668Reviewed-by: Takeshi Yoshino <tyoshino@chromium.org> Commit-Queue: Adam Rice <ricea@chromium.org> Cr-Commit-Position: refs/heads/master@{#491973}

Make a copy of String function in ReadableStream
The ReadableStream constructor uses the String function. However, the implementation was failing to take a copy of the function. This meant that the version from the Javascript environment was used. If it had been modified then it could result in incorrect behaviour. Use a copy of the original value of the String function in ReadableStream. This change also includes a regression test. BUG=752177 Change-Id: I52f36244a9d87131219958837e3cee00a8fc5fb4 Reviewed-on: https://chromium-review.googlesource.com/601668Reviewed-by: Takeshi Yoshino <tyoshino@chromium.org> Commit-Queue: Adam Rice <ricea@chromium.org> Cr-Commit-Position: refs/heads/master@{#491973}
be5214ee · Adam Rice · Commit Bot · 22a0e78c · be5214ee · be5214ee
Commit be5214ee authored Aug 04, 2017 by Adam Rice Committed by Commit Bot Aug 04, 2017
2 changed files
--- a/third_party/WebKit/LayoutTests/http/tests/streams/chromium/bad-string-constructor.html
+++ b/third_party/WebKit/LayoutTests/http/tests/streams/chromium/bad-string-constructor.html
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+// This is a regression test for
+// https://bugs.chromium.org/p/chromium/issues/detail?id=752177
+
+test(() => {
+  String = undefined;
+  new ReadableStream();
+}, 'Changing the global String object should not affect the ReadableStream' +
+    ' constructor');
+</script>
--- a/third_party/WebKit/Source/core/streams/ReadableStream.js
+++ b/third_party/WebKit/Source/core/streams/ReadableStream.js
@@ -50,6 +50,8 @@
  const TypeError = global.TypeError;
  const RangeError = global.RangeError;

+  const String = global.String;
+
  const Promise = global.Promise;
  const thenPromise = v8.uncurryThis(Promise.prototype.then);
  const Promise_resolve = v8.simpleBind(Promise.resolve, Promise);