feat: implement [[IsHTMLDDA]] internal slot (Annex B §B.3.6) (boa-dev#4980)

This Pull Request implements the `[[IsHTMLDDA]]` internal slot
(ECMAScript Annex B §B.3.6), enabling correct handling of
`document.all`-like objects.

It changes the following:

- Add `IsHTMLDDA` marker struct with a custom `[[Call]]` internal method
that returns `undefined` (`builtins/is_html_dda.rs`)
- Modify `typeof` operator to return `"undefined"` for objects with
`[[IsHTMLDDA]]` (`value/variant.rs`)
- Modify `ToBoolean` to return `false` for objects with `[[IsHTMLDDA]]`
(`value/inner/nan_boxed.rs`, `value/inner/legacy.rs`)
- Modify abstract equality (`==`) so that `[[IsHTMLDDA]]` objects are
loosely equal to `null` and `undefined` (`value/equality.rs`)
- Fix
`String.prototype.{match,matchAll,replace,replaceAll,search,split}` to
treat `[[IsHTMLDDA]]` objects as "undefined or null" in the spec's
"neither undefined nor null" check (`builtins/string/mod.rs`)
- Add `$262.IsHTMLDDA` to the Test262 harness
(`tests/tester/src/exec/js262.rs`)
- Remove `IsHTMLDDA` from ignored features in `test262_config.toml`

---------

Co-authored-by: Elior Nguyen <anhtunguyendev@wavenet.com.tw>

Author: xcb3d

core/engine/src/builtins/is_html_dda.rs

@@ -0,0 +1,66 @@
+//! Implementation of the `[[IsHTMLDDA]]` internal slot.
+//!
+//! Objects with this internal slot have special behavior:
+//! - `typeof` returns `"undefined"`
+//! - `ToBoolean` returns `false`
+//! - Abstract equality with `null` or `undefined` returns `true`
+//!
+//! More information:
+//!  - [ECMAScript reference][spec]
+//!
+//! [spec]: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
+
+use boa_gc::{Finalize, Trace};
+
+use crate::{
+    JsResult, JsValue,
+    object::{
+        JsData, JsObject,
+        internal_methods::{
+            CallValue, InternalMethodCallContext, InternalObjectMethods, ORDINARY_INTERNAL_METHODS,
+        },
+    },
+};
+
+/// Marker struct for objects with the `[[IsHTMLDDA]]` internal slot.
+///
+/// This is used by the `$262.IsHTMLDDA` test harness object and models the
+/// legacy `document.all` behavior per ECMAScript Annex B §B.3.6.
+///
+/// The object is callable — when called, it returns `undefined`.
+#[derive(Debug, Clone, Copy, Trace, Finalize)]
+#[boa_gc(empty_trace)]
+pub struct IsHTMLDDA;
+
+impl JsData for IsHTMLDDA {
+    fn internal_methods(&self) -> &'static InternalObjectMethods {
+        static IS_HTML_DDA_INTERNAL_METHODS: InternalObjectMethods = InternalObjectMethods {
+            __call__: is_html_dda_call,
+            ..ORDINARY_INTERNAL_METHODS
+        };
+        &IS_HTML_DDA_INTERNAL_METHODS
+    }
+}
+
+/// The `[[Call]]` internal method for `IsHTMLDDA` objects.
+///
+/// When called, simply returns `undefined`.
+#[allow(clippy::unnecessary_wraps)]
+fn is_html_dda_call(
+    _obj: &JsObject,
+    argument_count: usize,
+    context: &mut InternalMethodCallContext<'_>,
+) -> JsResult<CallValue> {
+    // Pop the arguments, function, and this from the stack.
+    let _args = context
+        .vm
+        .stack
+        .calling_convention_pop_arguments(argument_count);
+    let _func = context.vm.stack.pop();
+    let _this = context.vm.stack.pop();
+
+    // Push undefined as the return value.
+    context.vm.stack.push(JsValue::undefined());
+
+    Ok(CallValue::Complete)
+}

core/engine/src/builtins/mod.rs

@@ -15,6 +15,8 @@ pub mod eval;
 pub mod function;
 pub mod generator;
 pub mod generator_function;
+#[cfg(feature = "annex-b")]
+pub mod is_html_dda;
 pub mod iterable;
 pub mod json;
 pub mod map;

core/engine/src/value/equality.rs

@@ -1,4 +1,6 @@
 use super::{JsBigInt, JsObject, JsResult, JsValue, PreferredType};
+#[cfg(feature = "annex-b")]
+use crate::builtins::is_html_dda::IsHTMLDDA;
 use crate::{Context, JsVariant, builtins::Number};
 use std::collections::HashSet;
 
@@ -75,6 +77,20 @@ impl JsValue {
                 true
             }
 
+            // B.3.6.2: Objects with [[IsHTMLDDA]] are loosely equal to null and undefined.
+            #[cfg(feature = "annex-b")]
+            (JsVariant::Object(ref obj), JsVariant::Null | JsVariant::Undefined)
+                if obj.is::<IsHTMLDDA>() =>
+            {
+                true
+            }
+            #[cfg(feature = "annex-b")]
+            (JsVariant::Null | JsVariant::Undefined, JsVariant::Object(ref obj))
+                if obj.is::<IsHTMLDDA>() =>
+            {
+                true
+            }
+
             // 3. If Type(x) is Number and Type(y) is String, return the result of the comparison x == ! ToNumber(y).
             // 4. If Type(x) is String and Type(y) is Number, return the result of the comparison ! ToNumber(x) == y.
             //

core/engine/src/value/inner/legacy.rs

@@ -2,6 +2,8 @@
 //! interface as the `NanBoxedValue` type, but using an enum instead of
 //! a 64-bits float.
 
+#[cfg(feature = "annex-b")]
+use crate::builtins::is_html_dda::IsHTMLDDA;
 use crate::{JsBigInt, JsObject, JsSymbol, value::Type};
 use boa_engine::JsVariant;
 use boa_gc::{Finalize, Trace, custom_trace};
@@ -270,7 +272,11 @@ impl EnumBasedValue {
     #[inline]
     pub(crate) fn to_boolean(&self) -> bool {
         match self {
-            Self::Object(_) | Self::Symbol(_) => true,
+            Self::Symbol(_) => true,
+            // Objects are truthy, unless they have [[IsHTMLDDA]] (Annex B §B.3.6.1).
+            #[cfg(feature = "annex-b")]
+            Self::Object(obj) if obj.is::<IsHTMLDDA>() => false,
+            Self::Object(_) => true,
             Self::Null | Self::Undefined => false,
             Self::Integer32(n) => *n != 0,
             Self::Boolean(v) => *v,

core/engine/src/value/inner/nan_boxed.rs

@@ -106,6 +106,8 @@
 //! with regular NAN should happen.
 #![allow(clippy::inline_always)]
 
+#[cfg(feature = "annex-b")]
+use crate::builtins::is_html_dda::IsHTMLDDA;
 use crate::{
     JsBigInt, JsObject, JsSymbol, JsVariant, bigint::RawBigInt, object::ErasedVTableObject,
     symbol::RawJsSymbol, value::Type,
@@ -756,8 +758,19 @@ impl NanBoxedValue {
     #[inline(always)]
     pub(crate) fn to_boolean(&self) -> bool {
         match self.value() & bits::MASK_KIND {
-            // Objects and Symbols are always truthy.
-            bits::MASK_OBJECT | bits::MASK_SYMBOL => true,
+            // Symbols are always truthy.
+            bits::MASK_SYMBOL => true,
+            // Objects are truthy, unless they have [[IsHTMLDDA]] (Annex B §B.3.6.1).
+            bits::MASK_OBJECT => {
+                #[cfg(feature = "annex-b")]
+                {
+                    // SAFETY: tag confirmed this is an Object.
+                    if unsafe { self.as_object_unchecked().is::<IsHTMLDDA>() } {
+                        return false;
+                    }
+                }
+                true
+            }
             // Null and Undefined are always falsy.
             bits::MASK_OTHER => false,
             bits::MASK_INT32 => bits::untag_i32(self.value()) != 0,

core/engine/src/value/variant.rs

@@ -1,3 +1,5 @@
+#[cfg(feature = "annex-b")]
+use crate::builtins::is_html_dda::IsHTMLDDA;
 use crate::{JsBigInt, JsObject, JsSymbol, JsValue};
 use boa_engine::js_string;
 use boa_string::JsString;
@@ -71,6 +73,10 @@ impl JsVariant {
             JsVariant::Undefined => "undefined",
             JsVariant::BigInt(_) => "bigint",
             JsVariant::Object(object) => {
+                #[cfg(feature = "annex-b")]
+                if object.is::<IsHTMLDDA>() {
+                    return "undefined";
+                }
                 if object.is_callable() {
                     "function"
                 } else {
@@ -92,6 +98,10 @@ impl JsVariant {
             JsVariant::Undefined => js_string!("undefined"),
             JsVariant::BigInt(_) => js_string!("bigint"),
             JsVariant::Object(object) => {
+                #[cfg(feature = "annex-b")]
+                if object.is::<IsHTMLDDA>() {
+                    return js_string!("undefined");
+                }
                 if object.is_callable() {
                     js_string!("function")
                 } else {

test262_config.toml

@@ -8,7 +8,6 @@ features = [
     ### Unimplemented features:
 
     "FinalizationRegistry",
-    "IsHTMLDDA",
     "symbols-as-weakmap-keys",
     "Intl.DisplayNames",
     "Intl.RelativeTimeFormat",

tests/tester/Cargo.toml

@@ -32,7 +32,8 @@ bus.workspace = true
 cow-utils.workspace = true
 
 [features]
-default = ["boa_engine/intl_bundled", "boa_engine/experimental", "boa_engine/annex-b"]
+annex-b = ["boa_engine/annex-b"]
+default = ["boa_engine/intl_bundled", "boa_engine/experimental", "annex-b"]
 
 [lints]
 workspace = true

tests/tester/src/exec/js262.rs

@@ -6,6 +6,8 @@ use std::{
     time::Duration,
 };
 
+#[cfg(feature = "annex-b")]
+use boa_engine::builtins::is_html_dda::IsHTMLDDA;
 use boa_engine::{
     Context, JsArgs, JsNativeError, JsResult, JsValue, Source,
     builtins::array_buffer::{ArrayBuffer, SharedArrayBuffer},
@@ -107,6 +109,15 @@ pub(super) fn register_js262(
         )
         .build();
 
+    #[cfg(feature = "annex-b")]
+    js262
+        .create_data_property_or_throw(
+            js_string!("IsHTMLDDA"),
+            JsObject::from_proto_and_data(None, IsHTMLDDA),
+            context,
+        )
+        .expect("the IsHTMLDDA property must be definable");
+
     context
         .register_global_property(
             js_string!("$262"),