sukyoung / safe

Scalable Analysis Framework for ECMAScript
Other
118 stars 37 forks source link

Failed to conform to ES5.1, Section 8.7.2 PutValue (V, W), [[Put]], Step 7.a #2

Closed daejunpark closed 9 years ago

daejunpark commented 9 years ago

It seems to me that SAFE does not conform to ES5.1, Section 8.7.2 PutValue (V, W), [[Put]], Step 7.a.

For the following test program:

// 8.7.2 PutValue (V, W), [[Put]], Step 7.a

// 7. Else, this is a request to create an own property on the transient object O
//     a. If Throw is true, then throw a TypeError exception.

// For [[Put]] for a reference with a primitive base,
// if it does not have its own value, but a inherited data descriptor,
// then this assignment will create its own data descriptor which cannot be used later at all, because this object will immediately disappear after this assignment
// (at least there is no reference pointing to this object, so it's not accessible).
// Thus, if throw is true, then it throws TypeError.

"use strict";
1["x"] = 10; // TypeError

SAFE failed to throw a TypeError exception:

$ ./bin/jsaf interpret 07.js
Normal(10)

Is there anything that I'm missing?

sukyoung commented 9 years ago

Thank you for the report. Currently, SAFE focuses on static analysis of JavaScript programs rather than interpretation of them. While the SAFE bug detector using static analysis results partially supports the strict mode, it does not support this particular case due to limited manpower.