Revision: 15346
Author: [email protected]
Date: Thu Jun 27 00:42:08 2013
Log: Do not allow invocation of ArrayBuffer and array buffer views'
constructors as functions.
ES6 bug 695 (https://bugs.ecmascript.org/show_bug.cgi?id=695).
This never worked in WebKit, so no compatibility issues.
[email protected]
Review URL: https://codereview.chromium.org/17904007
http://code.google.com/p/v8/source/detail?r=15346
Modified:
/branches/bleeding_edge/src/arraybuffer.js
/branches/bleeding_edge/src/messages.js
/branches/bleeding_edge/src/typedarray.js
/branches/bleeding_edge/test/mjsunit/external-array-no-sse2.js
/branches/bleeding_edge/test/mjsunit/external-array.js
/branches/bleeding_edge/test/mjsunit/harmony/typedarrays.js
/branches/bleeding_edge/test/mjsunit/regress/regress-1383.js
=======================================
--- /branches/bleeding_edge/src/arraybuffer.js Mon Jun 24 06:58:52 2013
+++ /branches/bleeding_edge/src/arraybuffer.js Thu Jun 27 00:42:08 2013
@@ -36,7 +36,7 @@
var byteLength =
ToPositiveInteger(length, 'invalid_array_buffer_length');
%ArrayBufferInitialize(this, byteLength);
} else {
- return new $ArrayBuffer(length);
+ throw MakeTypeError('constructor_not_function', ["ArrayBuffer"]);
}
}
=======================================
--- /branches/bleeding_edge/src/messages.js Mon Jun 24 06:58:52 2013
+++ /branches/bleeding_edge/src/messages.js Thu Jun 27 00:42:08 2013
@@ -109,6 +109,7 @@
not_typed_array: ["this is not a typed array."],
invalid_argument: ["invalid_argument"],
data_view_not_array_buffer: ["First argument to DataView constructor
must be an ArrayBuffer"],
+ constructor_not_function: ["Constructor ", "%0", " requires 'new'"],
// RangeError
invalid_array_length: ["Invalid array length"],
invalid_array_buffer_length: ["Invalid array buffer length"],
=======================================
--- /branches/bleeding_edge/src/typedarray.js Mon Jun 24 06:58:52 2013
+++ /branches/bleeding_edge/src/typedarray.js Thu Jun 27 00:42:08 2013
@@ -97,7 +97,7 @@
throw MakeTypeError("parameterless_typed_array_constr", [name]);
}
} else {
- return new constructor(arg1, arg2, arg3);
+ throw MakeTypeError("constructor_not_function", [name])
}
}
}
@@ -223,7 +223,7 @@
}
%DataViewInitialize(this, buffer, offset, length);
} else {
- return new $DataView(buffer, byteOffset, byteLength)
+ throw MakeTypeError('constructor_not_function', ["DataView"]);
}
}
=======================================
--- /branches/bleeding_edge/test/mjsunit/external-array-no-sse2.js Wed May
22 02:17:27 2013
+++ /branches/bleeding_edge/test/mjsunit/external-array-no-sse2.js Thu Jun
27 00:42:08 2013
@@ -520,30 +520,15 @@
assertThrows(function(){ a.subarray.call({}, 0) });
assertThrows(function(){ a.subarray.call([], 0) });
-// Call constructors directly as functions, and through .call and .apply
+// Try to call constructors directly as functions, and through .call
+// and .apply. Should fail.
-b = ArrayBuffer(100)
-a = Int8Array(b, 5, 77)
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Int8Array)
-assertSame(b, a.buffer)
-assertEquals(5, a.byteOffset)
-assertEquals(77, a.byteLength)
-b = ArrayBuffer.call(null, 10)
-a = Uint16Array.call(null, b, 2, 4)
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Uint16Array)
-assertSame(b, a.buffer)
-assertEquals(2, a.byteOffset)
-assertEquals(8, a.byteLength)
-b = ArrayBuffer.apply(null, [1000])
-a = Float32Array.apply(null, [b, 128, 1])
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Float32Array)
-assertSame(b, a.buffer)
-assertEquals(128, a.byteOffset)
-assertEquals(4, a.byteLength)
-
+assertThrows(function() { ArrayBuffer(100); }, TypeError);
+assertThrows(function() { Int8Array(b, 5, 77); }, TypeError);
+assertThrows(function() { ArrayBuffer.call(null, 10); }, TypeError);
+assertThrows(function() { Uint16Array.call(null, b, 2, 4); }, TypeError);
+assertThrows(function() { ArrayBuffer.apply(null, [1000]); }, TypeError);
+assertThrows(function() { Float32Array.apply(null, [b, 128, 1]); },
TypeError);
// Test array.set in different combinations.
@@ -632,15 +617,15 @@
var b1 = b0.slice(0)
assertEquals(b0.byteLength, b1.byteLength)
-assertArrayPrefix([1, 2, 3, 4, 5, 6], Int8Array(b1))
+assertArrayPrefix([1, 2, 3, 4, 5, 6], new Int8Array(b1))
var b2 = b0.slice(3)
assertEquals(b0.byteLength - 3, b2.byteLength)
-assertArrayPrefix([4, 5, 6], Int8Array(b2))
+assertArrayPrefix([4, 5, 6], new Int8Array(b2))
var b3 = b0.slice(2, 4)
assertEquals(2, b3.byteLength)
-assertArrayPrefix([3, 4], Int8Array(b3))
+assertArrayPrefix([3, 4], new Int8Array(b3))
function goo(a, i) {
return a[i];
=======================================
--- /branches/bleeding_edge/test/mjsunit/external-array.js Wed May 22
02:17:27 2013
+++ /branches/bleeding_edge/test/mjsunit/external-array.js Thu Jun 27
00:42:08 2013
@@ -519,30 +519,15 @@
assertThrows(function(){ a.subarray.call({}, 0) });
assertThrows(function(){ a.subarray.call([], 0) });
-// Call constructors directly as functions, and through .call and .apply
+// Try to call constructors directly as functions, and through .call
+// and .apply. Should fail.
-b = ArrayBuffer(100)
-a = Int8Array(b, 5, 77)
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Int8Array)
-assertSame(b, a.buffer)
-assertEquals(5, a.byteOffset)
-assertEquals(77, a.byteLength)
-b = ArrayBuffer.call(null, 10)
-a = Uint16Array.call(null, b, 2, 4)
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Uint16Array)
-assertSame(b, a.buffer)
-assertEquals(2, a.byteOffset)
-assertEquals(8, a.byteLength)
-b = ArrayBuffer.apply(null, [1000])
-a = Float32Array.apply(null, [b, 128, 1])
-assertInstance(b, ArrayBuffer)
-assertInstance(a, Float32Array)
-assertSame(b, a.buffer)
-assertEquals(128, a.byteOffset)
-assertEquals(4, a.byteLength)
-
+assertThrows(function() { ArrayBuffer(100); }, TypeError);
+assertThrows(function() { Int8Array(b, 5, 77); }, TypeError);
+assertThrows(function() { ArrayBuffer.call(null, 10); }, TypeError);
+assertThrows(function() { Uint16Array.call(null, b, 2, 4); }, TypeError);
+assertThrows(function() { ArrayBuffer.apply(null, [1000]); }, TypeError);
+assertThrows(function() { Float32Array.apply(null, [b, 128, 1]); },
TypeError);
// Test array.set in different combinations.
@@ -631,15 +616,15 @@
var b1 = b0.slice(0)
assertEquals(b0.byteLength, b1.byteLength)
-assertArrayPrefix([1, 2, 3, 4, 5, 6], Int8Array(b1))
+assertArrayPrefix([1, 2, 3, 4, 5, 6], new Int8Array(b1))
var b2 = b0.slice(3)
assertEquals(b0.byteLength - 3, b2.byteLength)
-assertArrayPrefix([4, 5, 6], Int8Array(b2))
+assertArrayPrefix([4, 5, 6], new Int8Array(b2))
var b3 = b0.slice(2, 4)
assertEquals(2, b3.byteLength)
-assertArrayPrefix([3, 4], Int8Array(b3))
+assertArrayPrefix([3, 4], new Int8Array(b3))
function goo(a, i) {
return a[i];
=======================================
--- /branches/bleeding_edge/test/mjsunit/harmony/typedarrays.js Mon Jun 24
06:58:52 2013
+++ /branches/bleeding_edge/test/mjsunit/harmony/typedarrays.js Thu Jun 27
00:42:08 2013
@@ -563,5 +563,5 @@
// Test direct constructor call
-assertTrue(ArrayBuffer() instanceof ArrayBuffer);
-assertTrue(DataView(new ArrayBuffer()) instanceof DataView);
+assertThrows(function() { ArrayBuffer(); }, TypeError);
+assertThrows(function() { DataView(new ArrayBuffer()); }, TypeError);
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-1383.js Wed May 11
01:53:46 2011
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-1383.js Thu Jun 27
00:42:08 2013
@@ -33,7 +33,7 @@
function foo(){
"use strict";
var wxemsx=(4);
- var wxemsx_0=Float32Array(wxemsx);
+ var wxemsx_0=new Float32Array(wxemsx);
wxemsx_0[0]={};
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
