Revision: 23057
Author: [email protected]
Date: Mon Aug 11 19:24:05 2014 UTC
Log: ToNumber(Symbol) should throw TypeError
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-tonumber
Based on patch from caitp <[email protected]>
https://codereview.chromium.org/454233002/
BUG=v8:3499
LOG=Y
[email protected]
Review URL: https://codereview.chromium.org/458753004
Patch from Erik Arvidsson <[email protected]>.
http://code.google.com/p/v8/source/detail?r=23057
Modified:
/branches/bleeding_edge/src/messages.js
/branches/bleeding_edge/src/runtime.js
/branches/bleeding_edge/src/v8natives.js
/branches/bleeding_edge/test/mjsunit/es6/symbols.js
/branches/bleeding_edge/test/mjsunit/harmony/private.js
/branches/bleeding_edge/test/mjsunit/object-toprimitive.js
=======================================
--- /branches/bleeding_edge/src/messages.js Mon Jul 21 08:45:32 2014 UTC
+++ /branches/bleeding_edge/src/messages.js Mon Aug 11 19:24:05 2014 UTC
@@ -164,6 +164,7 @@
harmony_const_assign: ["Assignment to constant variable."],
symbol_to_string: ["Cannot convert a Symbol value to a
string"],
symbol_to_primitive: ["Cannot convert a Symbol wrapper object
to a primitive value"],
+ symbol_to_number: ["Cannot convert a Symbol value to a
number"],
invalid_module_path: ["Module does not export '", "%0", "', or
export is not itself a module"],
module_type_error: ["Module '", "%0", "' used improperly"],
module_export_undefined: ["Export '", "%0", "' is not defined in
module"]
=======================================
--- /branches/bleeding_edge/src/runtime.js Wed Jul 16 09:26:11 2014 UTC
+++ /branches/bleeding_edge/src/runtime.js Mon Aug 11 19:24:05 2014 UTC
@@ -36,6 +36,7 @@
while (true) {
if (IS_NUMBER(y)) return %NumberEquals(x, y);
if (IS_NULL_OR_UNDEFINED(y)) return 1; // not equal
+ if (IS_SYMBOL(y)) return 1; // not equal
if (!IS_SPEC_OBJECT(y)) {
// String or boolean.
return %NumberEquals(x, %ToNumber(y));
@@ -501,7 +502,7 @@
}
if (IS_BOOLEAN(x)) return x ? 1 : 0;
if (IS_UNDEFINED(x)) return NAN;
- if (IS_SYMBOL(x)) return NAN;
+ if (IS_SYMBOL(x)) throw MakeTypeError('symbol_to_number', []);
return (IS_NULL(x)) ? 0 : ToNumber(%DefaultNumber(x));
}
@@ -512,7 +513,7 @@
}
if (IS_BOOLEAN(x)) return x ? 1 : 0;
if (IS_UNDEFINED(x)) return NAN;
- if (IS_SYMBOL(x)) return NAN;
+ if (IS_SYMBOL(x)) throw MakeTypeError('symbol_to_number', []);
return (IS_NULL(x)) ? 0 : ToNumber(%DefaultNumber(x));
}
=======================================
--- /branches/bleeding_edge/src/v8natives.js Mon Aug 11 14:00:58 2014 UTC
+++ /branches/bleeding_edge/src/v8natives.js Mon Aug 11 19:24:05 2014 UTC
@@ -925,34 +925,36 @@
}
// Step 4 - Special handling for array index.
- var index = ToUint32(p);
- var emit_splice = false;
- if (ToString(index) == p && index != 4294967295) {
- var length = obj.length;
- if (index >= length && %IsObserved(obj)) {
- emit_splice = true;
- BeginPerformSplice(obj);
- }
+ if (!IS_SYMBOL(p)) {
+ var index = ToUint32(p);
+ var emit_splice = false;
+ if (ToString(index) == p && index != 4294967295) {
+ var length = obj.length;
+ if (index >= length && %IsObserved(obj)) {
+ emit_splice = true;
+ BeginPerformSplice(obj);
+ }
- var length_desc = GetOwnPropertyJS(obj, "length");
- if ((index >= length && !length_desc.isWritable()) ||
- !DefineObjectProperty(obj, p, desc, true)) {
- if (emit_splice)
+ var length_desc = GetOwnPropertyJS(obj, "length");
+ if ((index >= length && !length_desc.isWritable()) ||
+ !DefineObjectProperty(obj, p, desc, true)) {
+ if (emit_splice)
+ EndPerformSplice(obj);
+ if (should_throw) {
+ throw MakeTypeError("define_disallowed", [p]);
+ } else {
+ return false;
+ }
+ }
+ if (index >= length) {
+ obj.length = index + 1;
+ }
+ if (emit_splice) {
EndPerformSplice(obj);
- if (should_throw) {
- throw MakeTypeError("define_disallowed", [p]);
- } else {
- return false;
+ EnqueueSpliceRecord(obj, length, [], index + 1 - length);
}
- }
- if (index >= length) {
- obj.length = index + 1;
- }
- if (emit_splice) {
- EndPerformSplice(obj);
- EnqueueSpliceRecord(obj, length, [], index + 1 - length);
+ return true;
}
- return true;
}
// Step 5 - Fallback to default implementation.
=======================================
--- /branches/bleeding_edge/test/mjsunit/es6/symbols.js Fri Aug 8 11:42:59
2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/es6/symbols.js Mon Aug 11 19:24:05
2014 UTC
@@ -149,8 +149,8 @@
for (var i in symbols) {
assertThrows(function() { Number(Object(symbols[i])) }, TypeError)
assertThrows(function() { +Object(symbols[i]) }, TypeError)
- assertSame(NaN, Number(symbols[i]).valueOf())
- assertSame(NaN, symbols[i] + 0)
+ assertThrows(function() { Number(symbols[i]) }, TypeError)
+ assertThrows(function() { symbols[i] + 0 }, TypeError)
}
}
TestToNumber()
=======================================
--- /branches/bleeding_edge/test/mjsunit/harmony/private.js Tue Aug 5
19:37:32 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/harmony/private.js Mon Aug 11
19:24:05 2014 UTC
@@ -114,8 +114,8 @@
function TestToNumber() {
for (var i in symbols) {
- assertSame(NaN, Number(symbols[i]).valueOf())
- assertSame(NaN, symbols[i] + 0)
+ assertThrows(function() { Number(symbols[i]); }, TypeError);
+ assertThrows(function() { symbols[i] + 0; }, TypeError);
}
}
TestToNumber()
=======================================
--- /branches/bleeding_edge/test/mjsunit/object-toprimitive.js Thu Dec 16
12:49:55 2010 UTC
+++ /branches/bleeding_edge/test/mjsunit/object-toprimitive.js Mon Aug 11
19:24:05 2014 UTC
@@ -102,3 +102,5 @@
var nt = Number(ot);
assertEquals(87, nt);
assertEquals(["gvo", "gts", "ts"], trace);
+
+assertThrows('Number(Symbol())', TypeError);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
