Reviewers: Igor Sheludko, Toon Verwaest,
Message:
PTAL
Description:
Correct semantics for numerically indexed stores to typed arrays.
[email protected],[email protected]
Please review this at https://codereview.chromium.org/652303002/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+46, -0 lines):
M src/objects.cc
M test/mjsunit/harmony/typedarrays.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
3eedfe92faf08b10e71b512049509a7e197ceb26..b50f78266a1ea15db09286d9a42d19dfe2fcda8f
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2982,6 +2982,22 @@ MaybeHandle<Object>
Object::AddDataProperty(LookupIterator* it,
// instead. If the prototype is Null, the proxy is detached.
if (receiver->IsJSGlobalProxy()) return value;
+ // If the receiver is Indexed Exotic object (currently only typed
arrays),
+ // disallow adding properties with numeric names.
+ if (receiver->IsJSTypedArray() && it->name()->IsString()) {
+ Handle<String> name_string = Handle<String>::cast(it->name());
+ if (name_string->length() > 0) {
+ double d = StringToDouble(it->isolate()->unicode_cache(),
*name_string,
+ NO_FLAGS);
+ if (!std::isnan(d)) {
+ Factory* factory = it->isolate()->factory();
+ Handle<Object> num = factory->NewNumber(d);
+ Handle<String> roundtrip_string = factory->NumberToString(num);
+ if (String::Equals(name_string, roundtrip_string)) return value;
+ }
+ }
+ }
+
// Possibly migrate to the most up-to-date map that will be able to store
// |value| under it->name() with |attributes|.
it->PrepareTransitionToDataProperty(value, attributes, store_mode);
Index: test/mjsunit/harmony/typedarrays.js
diff --git a/test/mjsunit/harmony/typedarrays.js
b/test/mjsunit/harmony/typedarrays.js
index
5b75874cd40685897393613ab693a521318eb828..af5672966dd649ce9a807405ea2abb42eff9d925
100644
--- a/test/mjsunit/harmony/typedarrays.js
+++ b/test/mjsunit/harmony/typedarrays.js
@@ -481,6 +481,36 @@ function TestTypedArraySet() {
TestTypedArraySet();
+function TestTypedArraysWithIllegalIndices() {
+ var a = new Int32Array(100);
+
+ a[-10] = 10;
+ assertEquals(undefined, a[-10]);
+ a["-10"] = 10;
+ assertEquals(undefined, a["-10"]);
+
+ var s = " -10";
+ a[s] = 10;
+ assertEquals(10, a[s]);
+ var s1 = " -10 ";
+ a[s] = 10;
+ assertEquals(10, a[s]);
+
+ a["-1e2"] = 10;
+ assertEquals(10, a["-1e2"]);
+ assertEquals(undefined, a[-1e2]);
+
+ a[-Infinity] = 50;
+ assertEquals(undefined, a[-Infinity]);
+ a[1.5] = 10;
+ assertEquals(undefined, a[1.5]);
+ var nan = Math.sqrt(-1);
+ a[nan] = 5;
+ assertEquals(5, a[nan]);
+}
+
+TestTypedArraysWithIllegalIndices();
+
// DataView
function TestDataViewConstructor() {
var ab = new ArrayBuffer(256);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
