LibJS: Rewrite most of Object for spec compliance :^)

This is a huge patch, I know. In hindsight this perhaps could've been
done slightly more incremental, but I started and then fixed everything
until it worked, and here we are. I tried splitting of some completely
unrelated changes into separate commits, however. Anyway.

This is a rewrite of most of Object, and by extension large parts of
Array, Proxy, Reflect, String, TypedArray, and some other things.

What we already had worked fine for about 90% of things, but getting the
last 10% right proved to be increasingly difficult with the current code
that sort of grew organically and is only very loosely based on the
spec - this became especially obvious when we started fixing a large
number of test262 failures.

Key changes include:

- 1:1 matching function names and parameters of all object-related
  functions, to avoid ambiguity. Previously we had things like put(),
  which the spec doesn't have - as a result it wasn't always clear which
  need to be used.
- Better separation between object abstract operations and internal
  methods - the former are always the same, the latter can be overridden
  (and are therefore virtual). The internal methods (i.e. [[Foo]] in the
  spec) are now prefixed with 'internal_' for clarity - again, it was
  previously not always clear which AO a certain method represents,
  get() could've been both Get and [[Get]] (I don't know which one it
  was closer to right now).
  Note that some of the old names have been kept until all code relying
  on them is updated, but they are now simple wrappers around the
  closest matching standard abstract operation.
- Simplifications of the storage layer: functions that write values to
  storage are now prefixed with 'storage_' to make their purpose clear,
  and as they are not part of the spec they should not contain any steps
  specified by it. Much functionality is now covered by the layers above
  it and was removed (e.g. handling of accessors, attribute checks).
- PropertyAttributes has been greatly simplified, and is being replaced
  by PropertyDescriptor - a concept similar to the current
  implementation, but more aligned with the actual spec. See the commit
  message of the previous commit where it was introduced for details.
- As a bonus, and since I had to look at the spec a whole lot anyway, I
  introduced more inline comments with the exact steps from the spec -
  this makes it super easy to verify correctness.
- East-const all the things.

As a result of all of this, things are much more correct but a bit
slower now. Retaining speed wasn't a consideration at all, I have done
no profiling of the new code - there might be low hanging fruits, which
we can then harvest separately.

Special thanks to Idan for helping me with this by tracking down bugs,
updating everything outside of LibJS to work with these changes (LibWeb,
Spreadsheet, HackStudio), as well as providing countless patches to fix
regressions I introduced - there still are very few (we got it down to
5), but we also get many new passing test262 tests in return. :^)

Co-authored-by: Idan Horowitz <idan.horowitz@gmail.com>

1 files changed, 269 insertions, 31 deletions

diff --git a/Userland/Libraries/LibJS/Runtime/AbstractOperations.cpp b/Userland/Libraries/LibJS/Runtime/AbstractOperations.cpp
index 11d4302885..c6176fd17d 100644
--- a/Userland/Libraries/LibJS/Runtime/AbstractOperations.cpp
+++ b/Userland/Libraries/LibJS/Runtime/AbstractOperations.cpp
@@ -6,14 +6,15 @@
  */
 
 #include <AK/Function.h>
+#include <AK/Optional.h>
 #include <AK/Result.h>
 #include <AK/TemporaryChange.h>
 #include <LibJS/Interpreter.h>
 #include <LibJS/Parser.h>
 #include <LibJS/Runtime/AbstractOperations.h>
+#include <LibJS/Runtime/Accessor.h>
 #include <LibJS/Runtime/ArgumentsObject.h>
 #include <LibJS/Runtime/Array.h>
-#include <LibJS/Runtime/ArrayPrototype.h>
 #include <LibJS/Runtime/BoundFunction.h>
 #include <LibJS/Runtime/DeclarativeEnvironment.h>
 #include <LibJS/Runtime/ErrorTypes.h>
@@ -23,6 +24,7 @@
 #include <LibJS/Runtime/GlobalObject.h>
 #include <LibJS/Runtime/Object.h>
 #include <LibJS/Runtime/ObjectEnvironment.h>
+#include <LibJS/Runtime/PropertyDescriptor.h>
 #include <LibJS/Runtime/PropertyName.h>
 #include <LibJS/Runtime/ProxyObject.h>
 #include <LibJS/Runtime/Reference.h>
@@ -111,27 +113,202 @@ GlobalObject* get_function_realm(GlobalObject& global_object, FunctionObject con
 {
     auto& vm = global_object.vm();
 
-    if (function.realm())
+    // 1. Assert: ! IsCallable(obj) is true.
+
+    // 2. If obj has a [[Realm]] internal slot, then
+    if (function.realm()) {
+        // a. Return obj.[[Realm]].
         return function.realm();
+    }
+
+    // 3. If obj is a bound function exotic object, then
     if (is<BoundFunction>(function)) {
         auto& bound_function = static_cast<BoundFunction const&>(function);
+
+        // a. Let target be obj.[[BoundTargetFunction]].
         auto& target = bound_function.target_function();
+
+        // b. Return ? GetFunctionRealm(target).
         return get_function_realm(global_object, target);
     }
+
+    // 4. If obj is a Proxy exotic object, then
     if (is<ProxyObject>(function)) {
         auto& proxy = static_cast<ProxyObject const&>(function);
+
+        // a. If obj.[[ProxyHandler]] is null, throw a TypeError exception.
         if (proxy.is_revoked()) {
             vm.throw_exception<TypeError>(global_object, ErrorType::ProxyRevoked);
             return nullptr;
         }
+
+        // b. Let proxyTarget be obj.[[ProxyTarget]].
         auto& proxy_target = proxy.target();
+
+        // c. Return ? GetFunctionRealm(proxyTarget).
         VERIFY(proxy_target.is_function());
         return get_function_realm(global_object, static_cast<FunctionObject const&>(proxy_target));
     }
+
     // 5. Return the current Realm Record.
     return &global_object;
 }
 
+// 10.1.6.2 IsCompatiblePropertyDescriptor ( Extensible, Desc, Current ), https://tc39.es/ecma262/#sec-iscompatiblepropertydescriptor
+bool is_compatible_property_descriptor(bool extensible, PropertyDescriptor const& descriptor, Optional<PropertyDescriptor> const& current)
+{
+    // 1. Return ValidateAndApplyPropertyDescriptor(undefined, undefined, Extensible, Desc, Current).
+    return validate_and_apply_property_descriptor(nullptr, {}, extensible, descriptor, current);
+}
+
+// 10.1.6.3 ValidateAndApplyPropertyDescriptor ( O, P, extensible, Desc, current ),
+bool validate_and_apply_property_descriptor(Object* object, PropertyName const& property_name, bool extensible, PropertyDescriptor const& descriptor, Optional<PropertyDescriptor> const& current)
+{
+    // 1. Assert: If O is not undefined, then IsPropertyKey(P) is true.
+    if (object)
+        VERIFY(property_name.is_valid());
+
+    // 2. If current is undefined, then
+    if (!current.has_value()) {
+        // a. If extensible is false, return false.
+        if (!extensible)
+            return false;
+
+        // b. Assert: extensible is true.
+        // c. If IsGenericDescriptor(Desc) is true or IsDataDescriptor(Desc) is true, then
+        if (descriptor.is_generic_descriptor() || descriptor.is_data_descriptor()) {
+            // i. If O is not undefined, create an own data property named P of object O whose [[Value]], [[Writable]],
+            // [[Enumerable]], and [[Configurable]] attribute values are described by Desc.
+            // If the value of an attribute field of Desc is absent, the attribute of the newly created property is set
+            // to its default value.
+            if (object) {
+                auto value = descriptor.value.value_or(js_undefined());
+                object->storage_set(property_name, { value, descriptor.attributes() });
+            }
+        }
+        // d. Else,
+        else {
+            // i. Assert: ! IsAccessorDescriptor(Desc) is true.
+            VERIFY(descriptor.is_accessor_descriptor());
+
+            // ii. If O is not undefined, create an own accessor property named P of object O whose [[Get]], [[Set]],
+            // [[Enumerable]], and [[Configurable]] attribute values are described by Desc.
+            // If the value of an attribute field of Desc is absent, the attribute of the newly created property is set
+            // to its default value.
+            if (object) {
+                auto accessor = Accessor::create(object->vm(), descriptor.get.value_or(nullptr), descriptor.set.value_or(nullptr));
+                object->storage_set(property_name, { accessor, descriptor.attributes() });
+            }
+        }
+        // e. Return true.
+        return true;
+    }
+
+    // 3. If every field in Desc is absent, return true.
+    if (descriptor.is_empty())
+        return true;
+
+    // 4. If current.[[Configurable]] is false, then
+    if (!*current->configurable) {
+        // a. If Desc.[[Configurable]] is present and its value is true, return false.
+        if (descriptor.configurable.has_value() && *descriptor.configurable)
+            return false;
+
+        // b. If Desc.[[Enumerable]] is present and ! SameValue(Desc.[[Enumerable]], current.[[Enumerable]]) is false, return false.
+        if (descriptor.enumerable.has_value() && *descriptor.enumerable != *current->enumerable)
+            return false;
+    }
+
+    // 5. If ! IsGenericDescriptor(Desc) is true, then
+    if (descriptor.is_generic_descriptor()) {
+        // a. NOTE: No further validation is required.
+    }
+    // 6. Else if ! SameValue(! IsDataDescriptor(current), ! IsDataDescriptor(Desc)) is false, then
+    else if (current->is_data_descriptor() != descriptor.is_data_descriptor()) {
+        // a. If current.[[Configurable]] is false, return false.
+        if (!*current->configurable)
+            return false;
+
+        // b. If IsDataDescriptor(current) is true, then
+        if (current->is_data_descriptor()) {
+            // If O is not undefined, convert the property named P of object O from a data property to an accessor property.
+            // Preserve the existing values of the converted property's [[Configurable]] and [[Enumerable]] attributes and
+            // set the rest of the property's attributes to their default values.
+            if (object) {
+                auto accessor = Accessor::create(object->vm(), nullptr, nullptr);
+                object->storage_set(property_name, { accessor, current->attributes() });
+            }
+        }
+        // c. Else,
+        else {
+            // If O is not undefined, convert the property named P of object O from an accessor property to a data property.
+            // Preserve the existing values of the converted property's [[Configurable]] and [[Enumerable]] attributes and
+            // set the rest of the property's attributes to their default values.
+            if (object) {
+                auto value = js_undefined();
+                object->storage_set(property_name, { value, current->attributes() });
+            }
+        }
+    }
+    // 7. Else if IsDataDescriptor(current) and IsDataDescriptor(Desc) are both true, then
+    else if (current->is_data_descriptor() && descriptor.is_data_descriptor()) {
+        // a. If current.[[Configurable]] is false and current.[[Writable]] is false, then
+        if (!*current->configurable && !*current->writable) {
+            // i. If Desc.[[Writable]] is present and Desc.[[Writable]] is true, return false.
+            if (descriptor.writable.has_value() && *descriptor.writable)
+                return false;
+
+            // ii. If Desc.[[Value]] is present and SameValue(Desc.[[Value]], current.[[Value]]) is false, return false.
+            if (descriptor.value.has_value() && !same_value(*descriptor.value, *current->value))
+                return false;
+
+            // iii. Return true.
+            return true;
+        }
+    }
+    // 8. Else,
+    else {
+        // a. Assert: ! IsAccessorDescriptor(current) and ! IsAccessorDescriptor(Desc) are both true.
+        VERIFY(current->is_accessor_descriptor());
+        VERIFY(descriptor.is_accessor_descriptor());
+
+        // b. If current.[[Configurable]] is false, then
+        if (!*current->configurable) {
+            // i. If Desc.[[Set]] is present and SameValue(Desc.[[Set]], current.[[Set]]) is false, return false.
+            if (descriptor.set.has_value() && *descriptor.set != *current->set)
+                return false;
+
+            // ii. If Desc.[[Get]] is present and SameValue(Desc.[[Get]], current.[[Get]]) is false, return false.
+            if (descriptor.get.has_value() && *descriptor.get != *current->get)
+                return false;
+
+            // iii. Return true.
+            return true;
+        }
+    }
+
+    // 9. If O is not undefined, then
+    if (object) {
+        // a. For each field of Desc that is present, set the corresponding attribute of the property named P of object O to the value of the field.
+        Value value;
+        if (descriptor.is_accessor_descriptor() || (current->is_accessor_descriptor() && !descriptor.is_data_descriptor())) {
+            auto* getter = descriptor.get.value_or(current->get.value_or(nullptr));
+            auto* setter = descriptor.set.value_or(current->set.value_or(nullptr));
+            value = Accessor::create(object->vm(), getter, setter);
+        } else {
+            value = descriptor.value.value_or(current->value.value_or({}));
+        }
+        PropertyAttributes attributes;
+        attributes.set_writable(descriptor.writable.value_or(current->writable.value_or(false)));
+        attributes.set_enumerable(descriptor.enumerable.value_or(current->enumerable.value_or(false)));
+        attributes.set_configurable(descriptor.configurable.value_or(current->configurable.value_or(false)));
+        object->storage_set(property_name, { value, attributes });
+    }
+
+    // 10. Return true.
+    return true;
+}
+
 // 10.1.14 GetPrototypeFromConstructor ( constructor, intrinsicDefaultProto )
 Object* get_prototype_from_constructor(GlobalObject& global_object, FunctionObject const& constructor, Object* (GlobalObject::*intrinsic_default_prototype)())
 {
@@ -177,7 +354,7 @@ Object* get_super_constructor(VM& vm)
 {
     auto& env = get_this_environment(vm);
     auto& active_function = verify_cast<FunctionEnvironment>(env).function_object();
-    auto* super_constructor = active_function.prototype();
+    auto* super_constructor = active_function.internal_get_prototype_of();
     return super_constructor;
 }
 
@@ -230,26 +407,45 @@ Value perform_eval(Value x, GlobalObject& caller_realm, CallerMode strict_caller
 Object* create_unmapped_arguments_object(GlobalObject& global_object, Vector<Value> const& arguments)
 {
     auto& vm = global_object.vm();
-    auto* object = Object::create(global_object, global_object.object_prototype());
-    if (vm.exception())
-        return nullptr;
 
-    for (auto& argument : arguments)
-        object->indexed_properties().append(argument);
+    // 1. Let len be the number of elements in argumentsList.
+    auto length = arguments.size();
+
+    // 2. Let obj be ! OrdinaryObjectCreate(%Object.prototype%, « [[ParameterMap]] »).
+    // 3. Set obj.[[ParameterMap]] to undefined.
+    auto* object = Object::create(global_object, global_object.object_prototype());
 
     // 4. Perform DefinePropertyOrThrow(obj, "length", PropertyDescriptor { [[Value]]: 𝔽(len), [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }).
-    auto length = arguments.size();
-    object->define_property(vm.names.length, Value(length), Attribute::Writable | Attribute::Configurable);
-    if (vm.exception())
-        return nullptr;
+    object->define_property_or_throw(vm.names.length, { .value = Value(length), .writable = true, .enumerable = false, .configurable = true });
+    VERIFY(!vm.exception());
 
-    object->define_property(*vm.well_known_symbol_iterator(), global_object.array_prototype()->get(vm.names.values), Attribute::Writable | Attribute::Configurable);
+    // 5. Let index be 0.
+    // 6. Repeat, while index < len,
+    for (size_t index = 0; index < length; ++index) {
+        // a. Let val be argumentsList[index].
+        auto value = arguments[index];
 
-    // 8. Perform ! DefinePropertyOrThrow(obj, "callee", PropertyDescriptor { [[Get]]: %ThrowTypeError%, [[Set]]: %ThrowTypeError%, [[Enumerable]]: false, [[Configurable]]: false }).
-    object->define_accessor(vm.names.callee, global_object.throw_type_error_function(), global_object.throw_type_error_function(), 0);
+        // b. Perform ! CreateDataPropertyOrThrow(obj, ! ToString(𝔽(index)), val).
+        object->create_data_property_or_throw(index, value);
+        VERIFY(!vm.exception());
+
+        // c. Set index to index + 1.
+    }
+
+    // 7. Perform ! DefinePropertyOrThrow(obj, @@iterator, PropertyDescriptor { [[Value]]: %Array.prototype.values%, [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }).
+    // FIXME: This is not guaranteed to be %Array.prototype.values%!
+    auto array_prototype_values = global_object.array_prototype()->get(vm.names.values);
     if (vm.exception())
-        return nullptr;
+        return {};
+    object->define_property_or_throw(*vm.well_known_symbol_iterator(), { .value = array_prototype_values, .writable = true, .enumerable = false, .configurable = true });
+    VERIFY(!vm.exception());
+
+    // 8. Perform ! DefinePropertyOrThrow(obj, "callee", PropertyDescriptor { [[Get]]: %ThrowTypeError%, [[Set]]: %ThrowTypeError%, [[Enumerable]]: false, [[Configurable]]: false }).
+    auto* throw_type_error = global_object.throw_type_error_function();
+    object->define_property_or_throw(vm.names.callee, { .get = throw_type_error, .set = throw_type_error, .enumerable = false, .configurable = false });
+    VERIFY(!vm.exception());
 
+    // 9. Return obj.
     return object;
 }
 
@@ -260,33 +456,75 @@ Object* create_mapped_arguments_object(GlobalObject& global_object, FunctionObje
     (void)formals;
 
     auto& vm = global_object.vm();
+
+    // 1. Assert: formals does not contain a rest parameter, any binding patterns, or any initializers. It may contain duplicate identifiers.
+
+    // 2. Let len be the number of elements in argumentsList.
+    auto length = arguments.size();
+
+    // 3. Let obj be ! MakeBasicObject(« [[Prototype]], [[Extensible]], [[ParameterMap]] »).
     auto* object = vm.heap().allocate<ArgumentsObject>(global_object, global_object);
-    if (vm.exception())
-        return nullptr;
+    VERIFY(!vm.exception());
+
+    // 4. Set obj.[[GetOwnProperty]] as specified in 10.4.4.1.
+    // 5. Set obj.[[DefineOwnProperty]] as specified in 10.4.4.2.
+    // 6. Set obj.[[Get]] as specified in 10.4.4.3.
+    // 7. Set obj.[[Set]] as specified in 10.4.4.4.
+    // 8. Set obj.[[Delete]] as specified in 10.4.4.5.
+    // 9. Set obj.[[Prototype]] to %Object.prototype%.
 
     // 14. Let index be 0.
     // 15. Repeat, while index < len,
-    //     a. Let val be argumentsList[index].
-    //     b . Perform ! CreateDataPropertyOrThrow(obj, ! ToString(𝔽(index)), val).
-    //     c. Set index to index + 1.
-    for (auto& argument : arguments)
-        object->indexed_properties().append(argument);
+    for (size_t index = 0; index < length; ++index) {
+        // a. Let val be argumentsList[index].
+        auto value = arguments[index];
+
+        // b. Perform ! CreateDataPropertyOrThrow(obj, ! ToString(𝔽(index)), val).
+        object->create_data_property_or_throw(index, value);
+        VERIFY(!vm.exception());
+
+        // c. Set index to index + 1.
+    }
 
     // 16. Perform ! DefinePropertyOrThrow(obj, "length", PropertyDescriptor { [[Value]]: 𝔽(len), [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }).
-    auto length = arguments.size();
-    object->define_property(vm.names.length, Value(length), Attribute::Writable | Attribute::Configurable);
-    if (vm.exception())
-        return nullptr;
+    object->define_property_or_throw(vm.names.length, { .value = Value(length), .writable = true, .enumerable = false, .configurable = true });
+    VERIFY(!vm.exception());
 
     // 20. Perform ! DefinePropertyOrThrow(obj, @@iterator, PropertyDescriptor { [[Value]]: %Array.prototype.values%, [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }).
-    object->define_property(*vm.well_known_symbol_iterator(), global_object.array_prototype()->get(vm.names.values), Attribute::Writable | Attribute::Configurable);
+    // FIXME: This is not guaranteed to be %Array.prototype.values%!
+    auto array_prototype_values = global_object.array_prototype()->get(vm.names.values);
+    if (vm.exception())
+        return {};
+    object->define_property_or_throw(*vm.well_known_symbol_iterator(), { .value = array_prototype_values, .writable = true, .enumerable = false, .configurable = true });
+    VERIFY(!vm.exception());
 
     // 21. Perform ! DefinePropertyOrThrow(obj, "callee", PropertyDescriptor { [[Value]]: func, [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }).
-    object->define_property(vm.names.callee, Value(&function), Attribute::Writable | Attribute::Configurable);
-    if (vm.exception())
-        return nullptr;
+    object->define_property_or_throw(vm.names.callee, { .value = &function, .writable = true, .enumerable = false, .configurable = true });
+    VERIFY(!vm.exception());
 
+    // 22. Return obj.
     return object;
 }
 
+// 7.1.21 CanonicalNumericIndexString ( argument ), https://tc39.es/ecma262/#sec-canonicalnumericindexstring
+Value canonical_numeric_index_string(GlobalObject& global_object, Value argument)
+{
+    // 1. Assert: Type(argument) is String.
+    VERIFY(argument.is_string());
+
+    // 2. If argument is "-0", return -0𝔽.
+    if (argument.as_string().string() == "-0")
+        return Value(-0.0);
+
+    // 3. Let n be ! ToNumber(argument).
+    auto n = argument.to_number(global_object);
+
+    // 4. If SameValue(! ToString(n), argument) is false, return undefined.
+    if (!same_value(n.to_primitive_string(global_object), argument))
+        return js_undefined();
+
+    // 5. Return n.
+    return n;
+}
+
 }