[js weak cells] Implement makeCell corner cases

BUG=v8:8179

Change-Id: I29c5a5359a6e682ec6d94e9779f921889546b6a7
Reviewed-on: https://chromium-review.googlesource.com/c/1278393Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56711}

src/builtins/builtins-weak-refs.cc

@@ -34,15 +34,25 @@ BUILTIN(WeakFactoryConstructor) {
 
 BUILTIN(WeakFactoryMakeCell) {
   HandleScope scope(isolate);
+  const char* method = "WeakFactory.makeCell";
 
-  CHECK_RECEIVER(JSWeakFactory, weak_factory, "WeakFactory.makeCell");
-
-  Handle<Object> object = args.atOrUndefined(isolate, 1);
-  // TODO(marja): if the type is not an object, throw TypeError. Ditto for
-  // SameValue(target, holdings).
-  Handle<JSObject> js_object = Handle<JSObject>::cast(object);
+  CHECK_RECEIVER(JSWeakFactory, weak_factory, method);
 
+  Handle<Object> target = args.atOrUndefined(isolate, 1);
+  if (!target->IsJSReceiver()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate,
+        NewTypeError(MessageTemplate::kMakeCellTargetMustBeObject,
+                     isolate->factory()->NewStringFromAsciiChecked(method)));
+  }
+  Handle<JSReceiver> target_receiver = Handle<JSReceiver>::cast(target);
   Handle<Object> holdings = args.atOrUndefined(isolate, 2);
+  if (target->SameValue(*holdings)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate,
+        NewTypeError(MessageTemplate::kMakeCellTargetAndHoldingsMustNotBeSame,
+                     isolate->factory()->NewStringFromAsciiChecked(method)));
+  }
 
   // TODO(marja): Realms.
 
@@ -55,7 +65,7 @@ BUILTIN(WeakFactoryMakeCell) {
   Handle<JSWeakCell> weak_cell =
       Handle<JSWeakCell>::cast(isolate->factory()->NewJSObjectFromMap(
           weak_cell_map, TENURED, Handle<AllocationSite>::null()));
-  weak_cell->set_target(*js_object);
+  weak_cell->set_target(*target_receiver);
   weak_cell->set_holdings(*holdings);
   weak_factory->AddWeakCell(*weak_cell);
   return *weak_cell;

src/message-template.h

@@ -530,7 +530,12 @@ namespace internal {
   T(TraceEventNameLengthError,                                                 \
     "Trace event name must not be an empty string.")                           \
   T(TraceEventPhaseError, "Trace event phase must be a number.")               \
-  T(TraceEventIDError, "Trace event id must be a number.")
+  T(TraceEventIDError, "Trace event id must be a number.")                     \
+  /* Weak refs */                                                              \
+  T(MakeCellTargetMustBeObject,                                                \
+    "WeakFactory.makeCell: target must be an object")                          \
+  T(MakeCellTargetAndHoldingsMustNotBeSame,                                    \
+    "WeakFactory.makeCell: target and holdings must not be same")
 
 enum class MessageTemplate {
 #define TEMPLATE(NAME, STRING) k##NAME,

test/message/fail/weak-refs-makecell1.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs
+
+let wf = new WeakFactory();
+wf.makeCell(1);

test/message/fail/weak-refs-makecell1.out

+*%(basename)s:8: TypeError: WeakFactory.makeCell: target must be an object
+wf.makeCell(1);
+   ^
+TypeError: WeakFactory.makeCell: target must be an object
+    at WeakFactory.makeCell (<anonymous>)
+    at *%(basename)s:8:4

test/message/fail/weak-refs-makecell2.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs
+
+let wf = new WeakFactory();
+let o = {};
+wf.makeCell(o, o);

test/message/fail/weak-refs-makecell2.out

+*%(basename)s:9: TypeError: WeakFactory.makeCell: target and holdings must not be same
+wf.makeCell(o, o);
+   ^
+TypeError: WeakFactory.makeCell: target and holdings must not be same
+    at WeakFactory.makeCell (<anonymous>)
+    at *%(basename)s:9:4

test/mjsunit/harmony/weakrefs/basics.js

@@ -68,6 +68,35 @@
   assertSame(wc.holdings, holdings);
 })();
 
+(function TestMakeCellWithNonObject() {
+  let wf = new WeakFactory();
+  let message = "WeakFactory.makeCell: target must be an object";
+  assertThrows(() => wf.makeCell(), TypeError, message);
+  assertThrows(() => wf.makeCell(1), TypeError, message);
+  assertThrows(() => wf.makeCell(false), TypeError, message);
+  assertThrows(() => wf.makeCell("foo"), TypeError, message);
+  assertThrows(() => wf.makeCell(Symbol()), TypeError, message);
+})();
+
+(function TestMakeCellWithProxy() {
+  let handler = {};
+  let obj = {};
+  let proxy = new Proxy(obj, handler);
+  let wf = new WeakFactory();
+  let wc = wf.makeCell(proxy);
+})();
+
+(function TestMakeCellTargetAndHoldingsSameValue() {
+  let wf = new WeakFactory();
+  let obj = {a: 1};
+  // SameValue(target, holdings) not ok
+  assertThrows(() => wf.makeCell(obj, obj), TypeError,
+               "WeakFactory.makeCell: target and holdings must not be same");
+  // target == holdings ok
+  let holdings = {a: 1};
+  let wc = wf.makeCell(obj, holdings);
+})();
+
 (function TestMakeCellWithoutWeakFactory() {
   assertThrows(() => WeakFactory.prototype.makeCell.call({}, {}), TypeError);
   // Does not throw: