[WeakRefs] Make FinalizationGroup#register throw if token isn't an object

Bug: v8:8179
Change-Id: I6a4d7e899076fadf848c187f9f4d86a676455215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714865Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62870}

src/builtins/builtins-weak-refs.cc

@@ -48,14 +48,24 @@ BUILTIN(FinalizationGroupRegister) {
   HandleScope scope(isolate);
   const char* method_name = "FinalizationGroup.prototype.register";
 
+  //  1. Let finalizationGroup be the this value.
+  //
+  //  2. If Type(finalizationGroup) is not Object, throw a TypeError
+  //  exception.
+  //
+  //  4. If finalizationGroup does not have a [[Cells]] internal slot,
+  //  throw a TypeError exception.
   CHECK_RECEIVER(JSFinalizationGroup, finalization_group, method_name);
 
   Handle<Object> target = args.atOrUndefined(isolate, 1);
+
+  //  3. If Type(target) is not Object, throw a TypeError exception.
   if (!target->IsJSReceiver()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate,
         NewTypeError(MessageTemplate::kWeakRefsRegisterTargetMustBeObject));
   }
+
   Handle<Object> holdings = args.atOrUndefined(isolate, 2);
   if (target->SameValue(*holdings)) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -64,15 +74,21 @@ BUILTIN(FinalizationGroupRegister) {
             MessageTemplate::kWeakRefsRegisterTargetAndHoldingsMustNotBeSame));
   }
 
-  Handle<Object> key = args.atOrUndefined(isolate, 3);
-  // TODO(marja, gsathya): Restrictions on "key" (e.g., does it need to be an
-  // object).
+  Handle<Object> unregister_token = args.atOrUndefined(isolate, 3);
 
+  //  5. If Type(unregisterToken) is not Object,
+  //    a. If unregisterToken is not undefined, throw a TypeError exception.
+  if (!unregister_token->IsJSReceiver() && !unregister_token->IsUndefined()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate,
+        NewTypeError(MessageTemplate::kWeakRefsUnregisterTokenMustBeObject,
+                     unregister_token));
+  }
   // TODO(marja): Realms.
 
   JSFinalizationGroup::Register(finalization_group,
-                                Handle<JSReceiver>::cast(target), holdings, key,
-                                isolate);
+                                Handle<JSReceiver>::cast(target), holdings,
+                                unregister_token, isolate);
   return ReadOnlyRoots(isolate).undefined_value();
 }
 

test/test262/test262.status

@@ -537,7 +537,6 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=8179
   'built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback': [FAIL],
   'built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself': [FAIL],
-  'built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws': [FAIL],
   'built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws': [FAIL],
   'built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length': [FAIL],
   'built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws': [FAIL],