fix: 将 delete 属性操作改为显式 TypeError

This commit is contained in:
2026-06-08 23:17:47 +08:00
parent e5edbed91d
commit e62a9f0a10
2 changed files with 30 additions and 41 deletions
+6 -41
View File
@@ -1368,50 +1368,15 @@ impl Vm {
}
OpCode::DELETE_PROP_STATIC => {
let obj_val = self.regs[a];
if !obj_val.is_object() {
self.regs[rd] = JsValue::bool(true);
} else {
let obj_ptr = obj_val.as_js_object_ptr();
let obj = unsafe { &mut *obj_ptr };
let ext = self.bytecode[self.pc];
self.pc += 1;
let const_idx = ext as usize;
let prop_name_val = self.constants[const_idx];
if !prop_name_val.is_string() {
self.regs[rd] = JsValue::bool(true);
continue;
}
let prop_name_si = prop_name_val.as_string_index();
if let Some(pos) = self
.kernel
.shape_forge()
.lookup_position(obj.shape_id(), prop_name_si)
{
obj.set_prop_at(pos, JsValue::undefined());
}
self.regs[rd] = JsValue::bool(true);
}
let _ = self.bytecode[self.pc];
self.pc += 1;
throw_err!(self, TypeError, "property deletion not supported");
}
OpCode::DELETE_PROP_DYNAMIC => {
let obj_val = self.regs[a];
if !obj_val.is_object() {
self.regs[rd] = JsValue::bool(true);
} else {
let key_val = self.regs[b];
let prop_name_si = self.property_key_si(key_val);
let obj_ptr = obj_val.as_js_object_ptr();
let obj = unsafe { &mut *obj_ptr };
if let Some(pos) = self
.kernel
.shape_forge()
.lookup_position(obj.shape_id(), prop_name_si)
{
obj.set_prop_at(pos, JsValue::undefined());
}
self.regs[rd] = JsValue::bool(true);
}
let _ = self.regs[a];
let _ = self.regs[b];
throw_err!(self, TypeError, "property deletion not supported");
}
OpCode::INSTANCEOF => {
+24
View File
@@ -152,3 +152,27 @@ fn regression_new_expression_bytecode_constructor_error_is_catchable() {
"expected bytecode constructor capability error to enter catch"
);
}
#[test]
fn regression_delete_static_property_throws_type_error() {
assert_eq!(
eval("try { var o={x:1}; delete o.x; 0 } catch (e) { e.name == 'TypeError' }"),
"true"
);
assert_eq!(
eval("var o={x:1}; delete o.x"),
"vm error: uncaught TypeError: {object}"
);
}
#[test]
fn regression_delete_dynamic_property_throws_type_error() {
assert_eq!(
eval("try { var o={x:1}; delete o['x']; 0 } catch (e) { e.name == 'TypeError' }"),
"true"
);
assert_eq!(
eval("var o={x:1}; var k='x'; delete o[k]"),
"vm error: uncaught TypeError: {object}"
);
}