Title: [211182] branches/safari-603-branch
- Revision
- 211182
- Author
- [email protected]
- Date
- 2017-01-25 17:40:42 -0800 (Wed, 25 Jan 2017)
Log Message
Merge r211113. rdar://problem/30174692
Modified Paths
Added Paths
Diff
Modified: branches/safari-603-branch/JSTests/ChangeLog (211181 => 211182)
--- branches/safari-603-branch/JSTests/ChangeLog 2017-01-26 01:40:39 UTC (rev 211181)
+++ branches/safari-603-branch/JSTests/ChangeLog 2017-01-26 01:40:42 UTC (rev 211182)
@@ -1,3 +1,16 @@
+2017-01-25 Matthew Hanson <[email protected]>
+
+ Merge r211113. rdar://problem/30174692
+
+ 2017-01-24 Filip Pizlo <[email protected]>
+
+ -0 is a valid array index and AtomicsObject should know this
+ https://bugs.webkit.org/show_bug.cgi?id=167386
+
+ Reviewed by Mark Lam.
+
+ * stress/atomics-neg-zero.js: Added.
+
2017-01-24 Matthew Hanson <[email protected]>
Merge r211070. rdar://problem/30121809
Added: branches/safari-603-branch/JSTests/stress/atomics-neg-zero.js (0 => 211182)
--- branches/safari-603-branch/JSTests/stress/atomics-neg-zero.js (rev 0)
+++ branches/safari-603-branch/JSTests/stress/atomics-neg-zero.js 2017-01-26 01:40:42 UTC (rev 211182)
@@ -0,0 +1,3 @@
+var sab = new SharedArrayBuffer(4);
+var a = new Int32Array(sab);
+Atomics.add(a, -0, 1); // This should not throw.
Modified: branches/safari-603-branch/Source/_javascript_Core/ChangeLog (211181 => 211182)
--- branches/safari-603-branch/Source/_javascript_Core/ChangeLog 2017-01-26 01:40:39 UTC (rev 211181)
+++ branches/safari-603-branch/Source/_javascript_Core/ChangeLog 2017-01-26 01:40:42 UTC (rev 211182)
@@ -1,5 +1,18 @@
2017-01-25 Matthew Hanson <[email protected]>
+ Merge r211113. rdar://problem/30174692
+
+ 2017-01-24 Filip Pizlo <[email protected]>
+
+ -0 is a valid array index and AtomicsObject should know this
+ https://bugs.webkit.org/show_bug.cgi?id=167386
+
+ Reviewed by Mark Lam.
+
+ * runtime/AtomicsObject.cpp: The bug title really says it all.
+
+2017-01-25 Matthew Hanson <[email protected]>
+
Merge r211111. rdar://problem/30173375
2017-01-24 Filip Pizlo <[email protected]>
Modified: branches/safari-603-branch/Source/_javascript_Core/runtime/AtomicsObject.cpp (211181 => 211182)
--- branches/safari-603-branch/Source/_javascript_Core/runtime/AtomicsObject.cpp 2017-01-26 01:40:39 UTC (rev 211181)
+++ branches/safari-603-branch/Source/_javascript_Core/runtime/AtomicsObject.cpp 2017-01-26 01:40:42 UTC (rev 211182)
@@ -108,11 +108,16 @@
auto scope = DECLARE_THROW_SCOPE(vm);
JSValue accessIndexValue = exec->argument(1);
if (UNLIKELY(!accessIndexValue.isInt32())) {
- accessIndexValue = jsNumber(accessIndexValue.toNumber(exec));
+ double accessIndexDouble = accessIndexValue.toNumber(exec);
RETURN_IF_EXCEPTION(scope, 0);
- if (!accessIndexValue.isInt32()) {
- throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
- return 0;
+ if (accessIndexDouble == 0)
+ accessIndexValue = jsNumber(0);
+ else {
+ accessIndexValue = jsNumber(accessIndexDouble);
+ if (!accessIndexValue.isInt32()) {
+ throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
+ return 0;
+ }
}
}
int32_t accessIndex = accessIndexValue.asInt32();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
