Modified: trunk/LayoutTests/ChangeLog (92806 => 92807)
--- trunk/LayoutTests/ChangeLog 2011-08-11 00:43:42 UTC (rev 92806)
+++ trunk/LayoutTests/ChangeLog 2011-08-11 00:50:41 UTC (rev 92807)
@@ -1,3 +1,15 @@
+2011-08-10 Mark Hahnenberg <[email protected]>
+
+ JSC should always throw when function arg list is too long
+ https://bugs.webkit.org/show_bug.cgi?id=65869
+
+ Reviewed by Oliver Hunt.
+
+ Previous change forgot to update some of the tests in fast/js/function-apply.html so we're doing it now.
+
+ * fast/js/function-apply-expected.txt:
+ * fast/js/script-tests/function-apply.js:
+
2011-08-10 Abhishek Arya <[email protected]>
Tests that we do not crash when trying to access a removed
Modified: trunk/LayoutTests/fast/js/function-apply-expected.txt (92806 => 92807)
--- trunk/LayoutTests/fast/js/function-apply-expected.txt 2011-08-11 00:43:42 UTC (rev 92806)
+++ trunk/LayoutTests/fast/js/function-apply-expected.txt 2011-08-11 00:50:41 UTC (rev 92807)
@@ -33,9 +33,9 @@
PASS var a = []; a.length = 0xFFFE; [].constructor.apply('', a).length is 0xFFFE
PASS var a = []; a.length = 0xFFFF; [].constructor.apply('', a).length is 0xFFFF
PASS var a = []; a.length = 0x10000; [].constructor.apply('', a).length is 0x10000
-PASS var a = []; a.length = 0x10001; [].constructor.apply('', a).length is 0x10000
-PASS var a = []; a.length = 0xFFFFFFFE; [].constructor.apply('', a).length is 0x10000
-PASS var a = []; a.length = 0xFFFFFFFF; [].constructor.apply('', a).length is 0x10000
+PASS var a = []; a.length = 0x10001; [].constructor.apply('', a).length threw exception RangeError: Maximum call stack size exceeded..
+PASS var a = []; a.length = 0xFFFFFFFE; [].constructor.apply('', a).length threw exception RangeError: Maximum call stack size exceeded..
+PASS var a = []; a.length = 0xFFFFFFFF; [].constructor.apply('', a).length threw exception RangeError: Maximum call stack size exceeded..
PASS (function(a,b,c,d){ return d ? -1 : (a+b+c); }).apply(undefined, {length:3, 0:100, 1:20, 2:3}) is 123
PASS successfullyParsed is true
Modified: trunk/LayoutTests/fast/js/script-tests/function-apply.js (92806 => 92807)
--- trunk/LayoutTests/fast/js/script-tests/function-apply.js 2011-08-11 00:43:42 UTC (rev 92806)
+++ trunk/LayoutTests/fast/js/script-tests/function-apply.js 2011-08-11 00:50:41 UTC (rev 92807)
@@ -287,9 +287,9 @@
shouldBe("var a = []; a.length = 0xFFFE; [].constructor.apply('', a).length", "0xFFFE");
shouldBe("var a = []; a.length = 0xFFFF; [].constructor.apply('', a).length", "0xFFFF");
shouldBe("var a = []; a.length = 0x10000; [].constructor.apply('', a).length", "0x10000");
-shouldBe("var a = []; a.length = 0x10001; [].constructor.apply('', a).length", "0x10000");
-shouldBe("var a = []; a.length = 0xFFFFFFFE; [].constructor.apply('', a).length", "0x10000");
-shouldBe("var a = []; a.length = 0xFFFFFFFF; [].constructor.apply('', a).length", "0x10000");
+shouldThrow("var a = []; a.length = 0x10001; [].constructor.apply('', a).length");
+shouldThrow("var a = []; a.length = 0xFFFFFFFE; [].constructor.apply('', a).length");
+shouldThrow("var a = []; a.length = 0xFFFFFFFF; [].constructor.apply('', a).length");
// ES5 permits apply with array-like objects.
shouldBe("(function(a,b,c,d){ return d ? -1 : (a+b+c); }).apply(undefined, {length:3, 0:100, 1:20, 2:3})", '123');
