Title: [211113] trunk
- Revision
- 211113
- Author
- [email protected]
- Date
- 2017-01-24 15:24:35 -0800 (Tue, 24 Jan 2017)
Log Message
-0 is a valid array index and AtomicsObject should know this
https://bugs.webkit.org/show_bug.cgi?id=167386
Reviewed by Mark Lam.
JSTests:
* stress/atomics-neg-zero.js: Added.
Source/_javascript_Core:
* runtime/AtomicsObject.cpp: The bug title really says it all.
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (211112 => 211113)
--- trunk/JSTests/ChangeLog 2017-01-24 22:40:40 UTC (rev 211112)
+++ trunk/JSTests/ChangeLog 2017-01-24 23:24:35 UTC (rev 211113)
@@ -1,3 +1,12 @@
+2017-01-24 Filip Pizlo <[email protected]>
+
+ -0 is a valid array index and AtomicsObject should know this
+ https://bugs.webkit.org/show_bug.cgi?id=167386
+
+ Reviewed by Mark Lam.
+
+ * stress/atomics-neg-zero.js: Added.
+
2017-01-23 Saam Barati <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=167247
Added: trunk/JSTests/stress/atomics-neg-zero.js (0 => 211113)
--- trunk/JSTests/stress/atomics-neg-zero.js (rev 0)
+++ trunk/JSTests/stress/atomics-neg-zero.js 2017-01-24 23:24:35 UTC (rev 211113)
@@ -0,0 +1,3 @@
+var sab = new SharedArrayBuffer(4);
+var a = new Int32Array(sab);
+Atomics.add(a, -0, 1); // This should not throw.
Modified: trunk/Source/_javascript_Core/ChangeLog (211112 => 211113)
--- trunk/Source/_javascript_Core/ChangeLog 2017-01-24 22:40:40 UTC (rev 211112)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-01-24 23:24:35 UTC (rev 211113)
@@ -1,3 +1,12 @@
+2017-01-24 Filip Pizlo <[email protected]>
+
+ -0 is a valid array index and AtomicsObject should know this
+ https://bugs.webkit.org/show_bug.cgi?id=167386
+
+ Reviewed by Mark Lam.
+
+ * runtime/AtomicsObject.cpp: The bug title really says it all.
+
2017-01-24 Commit Queue <[email protected]>
Unreviewed, rolling out r211091.
Modified: trunk/Source/_javascript_Core/runtime/AtomicsObject.cpp (211112 => 211113)
--- trunk/Source/_javascript_Core/runtime/AtomicsObject.cpp 2017-01-24 22:40:40 UTC (rev 211112)
+++ trunk/Source/_javascript_Core/runtime/AtomicsObject.cpp 2017-01-24 23:24:35 UTC (rev 211113)
@@ -108,11 +108,16 @@
auto scope = DECLARE_THROW_SCOPE(vm);
JSValue accessIndexValue = exec->argument(1);
if (UNLIKELY(!accessIndexValue.isInt32())) {
- accessIndexValue = jsNumber(accessIndexValue.toNumber(exec));
+ double accessIndexDouble = accessIndexValue.toNumber(exec);
RETURN_IF_EXCEPTION(scope, 0);
- if (!accessIndexValue.isInt32()) {
- throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
- return 0;
+ if (accessIndexDouble == 0)
+ accessIndexValue = jsNumber(0);
+ else {
+ accessIndexValue = jsNumber(accessIndexDouble);
+ if (!accessIndexValue.isInt32()) {
+ throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
+ return 0;
+ }
}
}
int32_t accessIndex = accessIndexValue.asInt32();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
