Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (203095 => 203096)
--- trunk/Source/_javascript_Core/ChangeLog 2016-07-11 23:34:22 UTC (rev 203095)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-07-11 23:39:29 UTC (rev 203096)
@@ -1,3 +1,25 @@
+2016-07-11 Keith Miller <[email protected]>
+
+ defineProperty on a index of a TypedArray should throw if configurable
+ https://bugs.webkit.org/show_bug.cgi?id=159653
+
+ Reviewed by Saam Barati.
+
+ When I fixed this before I misread the spec and thought it said we
+ should throw if the descriptor said the proprety is not
+ configurable. This is the opposite. We should throw if the
+ descriptor says the property is configurable.
+
+ * runtime/JSGenericTypedArrayViewInlines.h:
+ (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+ * tests/stress/typedarray-access-monomorphic-neutered.js:
+ * tests/stress/typedarray-access-neutered.js:
+ * tests/stress/typedarray-configure-index.js: Added.
+ (assert):
+ (assertThrows):
+ (makeDescriptor):
+ (test):
+
2016-07-11 Saam Barati <[email protected]>
some paths in Array.prototype.splice don't account for the array not having certain indexed properties
Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewInlines.h (203095 => 203096)
--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewInlines.h 2016-07-11 23:34:22 UTC (rev 203095)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewInlines.h 2016-07-11 23:39:29 UTC (rev 203096)
@@ -348,9 +348,12 @@
if (descriptor.isAccessorDescriptor())
return reject(exec, shouldThrow, "Attempting to store accessor indexed property on a typed array.");
- if (descriptor.attributes() & (DontEnum | DontDelete | ReadOnly))
- return reject(exec, shouldThrow, "Attempting to store non-enumerable, non-configurable or non-writable indexed property on a typed array.");
+ if (descriptor.configurable())
+ return reject(exec, shouldThrow, "Attempting to configure non-configurable property.");
+ if (!descriptor.enumerable() || !descriptor.writable())
+ return reject(exec, shouldThrow, "Attempting to store non-enumerable or non-writable indexed property on a typed array.");
+
if (descriptor.value()) {
PutPropertySlot unused(JSValue(thisObject), shouldThrow);
return thisObject->put(thisObject, exec, propertyName, descriptor.value(), unused);
Modified: trunk/Source/_javascript_Core/tests/stress/typedarray-access-monomorphic-neutered.js (203095 => 203096)
--- trunk/Source/_javascript_Core/tests/stress/typedarray-access-monomorphic-neutered.js 2016-07-11 23:34:22 UTC (rev 203095)
+++ trunk/Source/_javascript_Core/tests/stress/typedarray-access-monomorphic-neutered.js 2016-07-11 23:39:29 UTC (rev 203096)
@@ -28,7 +28,7 @@
test("array[0]", array);
test("delete array[0]", array);
test("Object.getOwnPropertyDescriptor(array, 0)", array);
- test("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: true, enumerable: true })", array);
+ test("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true })", array);
test("array[0] = 1", array);
test("array[i] = 1", array);
}
@@ -48,7 +48,7 @@
testFTL("array[0]", array, failArray);
testFTL("delete array[0]", array, failArray);
testFTL("Object.getOwnPropertyDescriptor(array, 0)", array, failArray);
- testFTL("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: true, enumerable: true })", array, failArray);
+ testFTL("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true })", array, failArray);
testFTL("array[0] = 1", array, failArray);
testFTL("array[i] = 1", array, failArray);
}
Modified: trunk/Source/_javascript_Core/tests/stress/typedarray-access-neutered.js (203095 => 203096)
--- trunk/Source/_javascript_Core/tests/stress/typedarray-access-neutered.js 2016-07-11 23:34:22 UTC (rev 203095)
+++ trunk/Source/_javascript_Core/tests/stress/typedarray-access-neutered.js 2016-07-11 23:39:29 UTC (rev 203096)
@@ -25,6 +25,6 @@
test((array) => array[0], i);
test((array) => delete array[0], i);
test((array) => Object.getOwnPropertyDescriptor(array, 0), i);
- test((array) => Object.defineProperty(array, 0, { value: 1, writable: true, configurable: true, enumerable: true }), i)
+ test((array) => Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true }), i)
test((array) => array[0] = 1, i);
}
Added: trunk/Source/_javascript_Core/tests/stress/typedarray-configure-index.js (0 => 203096)
--- trunk/Source/_javascript_Core/tests/stress/typedarray-configure-index.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/typedarray-configure-index.js 2016-07-11 23:39:29 UTC (rev 203096)
@@ -0,0 +1,57 @@
+typedArrays = [Int8Array, Uint8Array, Uint8ClampedArray, Int16Array, Uint16Array, Int32Array, Uint32Array, Float32Array, Float64Array];
+
+function assert(cond) {
+ if (!cond)
+ throw new Error("bad assertion!");
+}
+
+function assertThrows(thunk, error) {
+ let failed = true;
+ try {
+ thunk();
+ } catch (e) {
+ if (error && e != error)
+ throw new Error("bad assertion!");
+ failed = false;
+ }
+ if (failed)
+ throw new Error("bad assertion!");
+}
+
+function makeDescriptor(accessor, configurable, writable, enumerable) {
+ let o = {writable, configurable, enumerable}
+ if (accessor)
+ o.get = () => 1;
+ else
+ o.value = 1;
+ return o;
+}
+
+let bools = [true, false];
+
+function test(array, a, c, error ) {
+ for (w of bools) {
+ for (e of bools) {
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(a, c, w, e), error));
+ }
+ }
+}
+
+function foo() {
+ for (constructor of typedArrays) {
+ let a = new constructor(10);
+ Object.defineProperty(a, 0, makeDescriptor(false, false, true, true));
+ assert(a[0] === 1);
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, true, false), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, false), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, true), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
+
+ test(a, false, true, "TypeError: Attempting to configure non-configurable property.");
+ for (c of bools) {
+ test(a, true, c, "TypeError: Attempting to store accessor indexed property on a typed array.")
+ }
+ }
+}
+
+for (let i = 0; i < 100; i++)
+ foo();
