Diff
Modified: trunk/LayoutTests/ChangeLog (202925 => 202926)
--- trunk/LayoutTests/ChangeLog 2016-07-07 19:00:45 UTC (rev 202925)
+++ trunk/LayoutTests/ChangeLog 2016-07-07 19:03:27 UTC (rev 202926)
@@ -1,5 +1,15 @@
2016-07-07 Benjamin Poulain <[email protected]>
+ [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
+ https://bugs.webkit.org/show_bug.cgi?id=159505
+
+ Reviewed by Mark Lam.
+
+ * js/array-includes-expected.txt:
+ * js/script-tests/array-includes.js:
+
+2016-07-07 Benjamin Poulain <[email protected]>
+
[JSC] String.prototype.normalize should have a length of zero
https://bugs.webkit.org/show_bug.cgi?id=159506
Modified: trunk/LayoutTests/js/array-includes-expected.txt (202925 => 202926)
--- trunk/LayoutTests/js/array-includes-expected.txt 2016-07-07 19:00:45 UTC (rev 202925)
+++ trunk/LayoutTests/js/array-includes-expected.txt 2016-07-07 19:03:27 UTC (rev 202926)
@@ -34,6 +34,37 @@
PASS var obj = { 0: 1, 1: 1, 2: 1, length: 0 }; Array.prototype.includes.call(obj, 1) is false
PASS var obj = { 0: 1, 1: 1, 2: 1, length: -0 }; Array.prototype.includes.call(obj, 1) is false
PASS var obj = { 0: 1, 1: 1, 2: 1, length: -3 }; Array.prototype.includes.call(obj, 1) is false
+The index is converted to integer
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, NaN) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, NaN) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, NaN) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Infinity) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Infinity) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Infinity) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, -Infinity) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, -Infinity) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, -Infinity) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER + 1) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER + 1) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER + 1) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER - 1) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER - 1) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER - 1) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, { valueOf: () => { return 1; } }) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, { valueOf: () => { return 1; } }) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, { valueOf: () => { return 1; } }) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, { toString: () => { return '1'; } }) is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, { toString: () => { return '1'; } }) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, { toString: () => { return '1'; } }) is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, '1') is false
+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, '1') is true
+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, '1') is true
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/js/script-tests/array-includes.js (202925 => 202926)
--- trunk/LayoutTests/js/script-tests/array-includes.js 2016-07-07 19:00:45 UTC (rev 202925)
+++ trunk/LayoutTests/js/script-tests/array-includes.js 2016-07-07 19:03:27 UTC (rev 202926)
@@ -47,3 +47,38 @@
shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: 0 }; Array.prototype.includes.call(obj, 1)");
shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: -0 }; Array.prototype.includes.call(obj, 1)");
shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: -3 }; Array.prototype.includes.call(obj, 1)");
+
+debug("The index is converted to integer");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, NaN)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, NaN)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, NaN)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Infinity)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Infinity)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Infinity)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, -Infinity)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, -Infinity)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, -Infinity)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER + 1)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER + 1)");
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER + 1)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER - 1)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER - 1)");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER - 1)");
+
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, { valueOf: () => { return 1; } })");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, { valueOf: () => { return 1; } })");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, { valueOf: () => { return 1; } })");
+
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, { toString: () => { return '1'; } })");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, { toString: () => { return '1'; } })");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, { toString: () => { return '1'; } })");
+
+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, '1')");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, '1')");
+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, '1')");
Modified: trunk/Source/_javascript_Core/ChangeLog (202925 => 202926)
--- trunk/Source/_javascript_Core/ChangeLog 2016-07-07 19:00:45 UTC (rev 202925)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-07-07 19:03:27 UTC (rev 202926)
@@ -1,5 +1,20 @@
2016-07-07 Benjamin Poulain <[email protected]>
+ [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
+ https://bugs.webkit.org/show_bug.cgi?id=159505
+
+ Reviewed by Mark Lam.
+
+ The code was using (value)|0 which is effectively a ToInt32.
+ This fails on large integers and +-Infinity.
+
+ Spec: https://tc39.github.io/ecma262/#sec-array.prototype.includes
+
+ * builtins/ArrayPrototype.js:
+ (includes):
+
+2016-07-07 Benjamin Poulain <[email protected]>
+
[JSC] String.prototype.normalize should have a length of zero
https://bugs.webkit.org/show_bug.cgi?id=159506
Modified: trunk/Source/_javascript_Core/builtins/ArrayPrototype.js (202925 => 202926)
--- trunk/Source/_javascript_Core/builtins/ArrayPrototype.js 2016-07-07 19:00:45 UTC (rev 202925)
+++ trunk/Source/_javascript_Core/builtins/ArrayPrototype.js 2016-07-07 19:03:27 UTC (rev 202926)
@@ -434,7 +434,7 @@
var fromIndex = 0;
if (arguments.length > 1 && arguments[1] !== @undefined)
- fromIndex = arguments[1] | 0;
+ fromIndex = @toInteger(arguments[1]);
var index;
if (fromIndex >= 0)
