9.2.5 ResolveLocale (availableLocales, requestedLocales, options, relevantExtensionKeys,
localeData)
Step 6.c: Unsafe use of %StringProto_split%, user code may have added a custom `String.prototype[Symbol.split]` function.
I don't know an elegant way to resolve this, the ugly workaround is:
> Let strExtension be StringCreate(extension, null).
> Perform CreateDataProperty(strExtension, %StringProto_toString%).
> Let extensionSubtags be Call(%StringProto_split%, strExtension, «"-"»).
Step 6.d: Unnecessary ToObject call, invalid CreateArrayFromList call.
Step 6.d: Change ")." to normal instead bold font.
Step 11: Unnecessary ToObject call
Step 11: Typo "ArrayCreateFromList" -> "CreateArrayFromList"
Step 12: Unnecessary ReturnIfAbrupt, CreateArrayFromList is not fallible.
Step 13: Change ")." to normal instead bold font.
Steps 13-14: Merge steps
> Let len be ToLength(Get(rExtensionKeys, "length")).
Step 15.j.i: Typo "%StringProto_indexOf%" -> "%ArrayProto_indexOf%" (`extensionSubtags` is an Array object).
Step 15.j.ii.1: This Get() call only needs to happen if `keyPos + 1 < extensionSubtagsLength`, otherwise an index greater than the array length is accessed which is observable if accessor properties on Array.prototype or anywhere along the prototype chain are present.
Step 15.j.ii.2: Change `extensionSubtagsKeyPos` to italic font.
Step 15.j.ii.3.b: Unsafe use of %StringProto_includes%, user code may have added `String.prototype[Symbol.match]`.
Step 15.j.ii.4: Unsafe use of %StringProto_includes%, user code may have added `String.prototype[Symbol.match]`.
Step 15.j.ii.4: Duplicate comma
Step 15.k.iii: Unsafe use of %StringProto_includes%, user code may have added `String.prototype[Symbol.match]`.
Step 16: Invalid use of CreateArrayFromList
> 16. If the number of elements in supportedExtension is greater than 2, then
This requires a lot of changes to this operation that I'm not comfortable making this late in process. All the "unsafe" markings don't make sense considering they are defined as the "initial value"—it's just a specification mechanism, so it doesn't matter if user code changes anything. This practice is something that Allen and I discussed at length before I started incorporating it into the document. I'm going to fix the typos and smaller technical corrections, but I'm not going to rewrite all the uses of intrinsics.
>Step 6.d: Unnecessary ToObject call, invalid CreateArrayFromList call.
>Step 6.d: Change ")." to normal instead bold font.
>Step 11: Unnecessary ToObject call
>Step 11: Typo "ArrayCreateFromList" -> "CreateArrayFromList"
>Step 12: Unnecessary ReturnIfAbrupt, CreateArrayFromList is not fallible.
>Step 13: Change ")." to normal instead bold font.
> Steps 13-14: Merge steps
> Let len be ToLength(Get(rExtensionKeys, "length")).
> Step 15.j.i: Typo "%StringProto_indexOf%" -> "%ArrayProto_indexOf%"
> (`extensionSubtags` is an Array object).
>Step 15.j.ii.1: This Get() call only needs to happen if `keyPos + 1 < extensionSubtagsLength`, otherwise an index greater than the array length is accessed which is observable if accessor properties on Array.prototype or anywhere along the prototype chain are present.
> Step 16: Invalid use of CreateArrayFromList
> 16. If the number of elements in supportedExtension is greater than 2, then
Fixed.
ArrayProto_indexOf added to well known intrinsics extensions table.
(In reply to Rick Waldron from comment #1)
> This requires a lot of changes to this operation that I'm not comfortable
> making this late in process. All the "unsafe" markings don't make sense
> considering they are defined as the "initial value"—it's just a
> specification mechanism, so it doesn't matter if user code changes anything.
> This practice is something that Allen and I discussed at length before I
> started incorporating it into the document. I'm going to fix the typos and
> smaller technical corrections, but I'm not going to rewrite all the uses of
> intrinsics.
9.2.5 ResolveLocale calls %StringProto_split% with Type(extension) = String.
ES2015, rev38, 21.1.3.17 String.prototype.split, step 3:
---
3. If separator is not undefined, then
a. Let splitter be GetMethod(separator, @@split).
b. ReturnIfAbrupt(splitter).
c. If splitter is not undefined , then
i. Return Call(splitter, separator, «O, limit»).
---
So the String.prototype.split `separator` parameter is a string value. If a user has added `String.prototype[Symbol.split] = () => []`, step 3.a returns that arrow function and step 3.a.i is executed. That means the `extensionSubtags` variable in ResolveLocale is always an empty array - independent of its input parameters.
And I was wrong about %StringProto_includes%: %StringProto_includes% is safe to use, I didn't check that IsRegExp returns false for non-object types.