Diff
Modified: branches/safari-602-branch/Source/_javascript_Core/ChangeLog (203359 => 203360)
--- branches/safari-602-branch/Source/_javascript_Core/ChangeLog 2016-07-18 19:07:09 UTC (rev 203359)
+++ branches/safari-602-branch/Source/_javascript_Core/ChangeLog 2016-07-18 19:12:24 UTC (rev 203360)
@@ -1,5 +1,25 @@
2016-07-18 Babak Shafiei <[email protected]>
+ Merge r203351.
+
+ 2016-07-18 Keith Miller <[email protected]>
+
+ Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
+ https://bugs.webkit.org/show_bug.cgi?id=159882
+ <rdar://problem/27327111>
+
+ Reviewed by Mark Lam.
+
+ According the spec toInteger can return values we don't consider ints.
+ Such as, -0 and +/-Infinity. This broke some assertions in
+ genericTypedArrayViewPrivateFuncSubarrayCreate.
+
+ * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+ (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+ * tests/stress/typedarray-subarray.js:
+
+2016-07-18 Babak Shafiei <[email protected]>
+
Merge patch for rdar://problem/27360961.
2016-06-23 Dean Jackson <[email protected]>
Modified: branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (203359 => 203360)
--- branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2016-07-18 19:07:09 UTC (rev 203359)
+++ branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2016-07-18 19:12:24 UTC (rev 203360)
@@ -496,8 +496,11 @@
// Get the length here; later assert that the length didn't change.
unsigned thisLength = thisObject->length();
- ASSERT(exec->argument(0).isAnyInt());
- ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isAnyInt());
+ // I would assert that the arguments are integers here but that's not true since
+ // https://tc39.github.io/ecma262/#sec-tointeger allows the result of the operation
+ // to be +/- Infinity and -0.
+ ASSERT(exec->argument(0).isNumber());
+ ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isNumber());
unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, thisLength);
ASSERT(!vm.exception());
unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, thisLength, thisLength);
Modified: branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js (203359 => 203360)
--- branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js 2016-07-18 19:07:09 UTC (rev 203359)
+++ branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js 2016-07-18 19:12:24 UTC (rev 203360)
@@ -58,4 +58,21 @@
shouldBeTrue("forEachTypedArray(subclasses, testSpeciesRemoveConstructor)");
+debug("5.0 Coercion First Argument");
+shouldBeTrue("testPrototypeFunction('subarray', '(true)', [1, 2, 3, 4], [2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(\"abc\")', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '({ valueOf() { return Infinity; } })', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '({ valueOf() { return -0; } })', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(null)', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(undefined)', [1, 2, 3, 4], [1, 2, 3, 4])");
+
+debug("5.1 Coercion Second Argument");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, true)', [1, 2, 3, 4], [1])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, \"abc\")', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, \"1\")', [1, 2, 3, 4], [1])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, undefined)', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, { valueOf() { return Infinity; } })', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, { valueOf() { return -0; } })', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, null)', [1, 2, 3, 4], [])");
+
finishJSTest();
_______________________________________________ webkit-changes mailing list [email protected] https://lists.webkit.org/mailman/listinfo/webkit-changes
