Diff
Modified: branches/safari-603-branch/LayoutTests/ChangeLog (212525 => 212526)
--- branches/safari-603-branch/LayoutTests/ChangeLog 2017-02-17 05:28:00 UTC (rev 212525)
+++ branches/safari-603-branch/LayoutTests/ChangeLog 2017-02-17 05:28:03 UTC (rev 212526)
@@ -1,5 +1,29 @@
2017-02-16 Matthew Hanson <[email protected]>
+ Merge r212301. rdar://problem/30494674
+
+ 2017-02-13 Filip Pizlo <[email protected]>
+
+ worker.postMessage should throw a TypeError if a SharedArrayBuffer is in the transfer list
+ https://bugs.webkit.org/show_bug.cgi?id=168277
+
+ Reviewed by Mark Lam.
+
+ Add a test of the new behavior, and remove tests for the old behavior.
+
+ Most of the SharedArrayBuffer tests use the new style, where the buffer is not in the
+ transfer list, and the tests being removed are clones of the no-transfer tests. So, we
+ aren't losing any coverage.
+
+ * workers/sab/null-worker.js: Added.
+ * workers/sab/postMessage-transfer-type-error-expected.txt: Added.
+ * workers/sab/postMessage-transfer-type-error.html: Added.
+ * workers/sab/sab-creator-transfer.js: Removed. (Sibling: sab-creator-no-transfer.js)
+ * workers/sab/sent-from-worker-transfer.html: Removed. (Sibling: sent-from-worker-no-transfer.html)
+ * workers/sab/simple.html: Removed. (Sibling: no-transfer.html)
+
+2017-02-16 Matthew Hanson <[email protected]>
+
Merge r212214. rdar://problem/30451581
2017-02-12 Ryosuke Niwa <[email protected]>
Added: branches/safari-603-branch/LayoutTests/workers/sab/null-worker.js (0 => 212526)
--- branches/safari-603-branch/LayoutTests/workers/sab/null-worker.js (rev 0)
+++ branches/safari-603-branch/LayoutTests/workers/sab/null-worker.js 2017-02-17 05:28:03 UTC (rev 212526)
@@ -0,0 +1 @@
+// This does nothing.
Added: branches/safari-603-branch/LayoutTests/workers/sab/postMessage-transfer-type-error-expected.txt (0 => 212526)
--- branches/safari-603-branch/LayoutTests/workers/sab/postMessage-transfer-type-error-expected.txt (rev 0)
+++ branches/safari-603-branch/LayoutTests/workers/sab/postMessage-transfer-type-error-expected.txt 2017-02-17 05:28:03 UTC (rev 212526)
@@ -0,0 +1,10 @@
+Checks that worker.postMessage rejects SharedArrayBuffers in the transfer list
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS postMessageTransferSharedArrayBuffer() threw exception TypeError: Type error.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: branches/safari-603-branch/LayoutTests/workers/sab/postMessage-transfer-type-error.html (0 => 212526)
--- branches/safari-603-branch/LayoutTests/workers/sab/postMessage-transfer-type-error.html (rev 0)
+++ branches/safari-603-branch/LayoutTests/workers/sab/postMessage-transfer-type-error.html 2017-02-17 05:28:03 UTC (rev 212526)
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script>
+description("Checks that worker.postMessage rejects SharedArrayBuffers in the transfer list");
+
+function postMessageTransferSharedArrayBuffer()
+{
+ var sab = new SharedArrayBuffer(4);
+ var memory = new Int32Array(sab);
+ new Worker("null-worker.js").postMessage(memory, [sab]);
+}
+
+shouldThrowErrorName("postMessageTransferSharedArrayBuffer()", "TypeError");
+</script>
+<script src=""
+</body>
+</html>
Deleted: branches/safari-603-branch/LayoutTests/workers/sab/simple.html (212525 => 212526)
--- branches/safari-603-branch/LayoutTests/workers/sab/simple.html 2017-02-17 05:28:00 UTC (rev 212525)
+++ branches/safari-603-branch/LayoutTests/workers/sab/simple.html 2017-02-17 05:28:03 UTC (rev 212526)
@@ -1,90 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-</head>
-<body>
-<script>
-function getOrCreate(id, tagName)
-{
- var element = document.getElementById(id);
- if (element)
- return element;
-
- element = document.createElement(tagName);
- element.id = id;
- var parent = document.body || document.documentElement;
- var refNode = parent.firstChild;
-
- parent.insertBefore(element, refNode);
- return element;
-}
-
-function debug(msg)
-{
- var span = document.createElement("span");
- getOrCreate("console", "div").appendChild(span); // insert it first so XHTML knows the namespace
- span.innerHTML = msg + '<br />';
-}
-
-if (window.testRunner) {
- testRunner.dumpAsText();
- testRunner.waitUntilDone();
-}
-
-var verbose = false;
-
-var sab = new SharedArrayBuffer(100 * 4);
-
-var memory = new Int32Array(sab);
-
-var numWorkers = 0;
-function startWorker(file)
-{
- if (verbose)
- debug("Starting worker: " + file);
- numWorkers++;
- var worker = new Worker(file);
- worker._onmessage_ = function(event) {
- if (event.data == "done") {
- if (verbose)
- debug("Finished worker: " + file);
- if (--numWorkers)
- return;
- debug("All workers done!");
- done();
- return;
- }
- if (event.data.indexOf("Error") == 0) {
- debug("Test failed: "+ event.data);
- if (window.testRunner)
- testRunner.notifyDone();
- }
-
- if (verbose)
- debug("Event from " + file + ": " + event.data);
- };
- worker.postMessage(memory, [sab]);
-}
-
-function done()
-{
- for (var i = 0; i < 3; ++i) {
- if (memory[i] != 1)
- throw "Error: Bad value at memory[" + i + "]: " + memory[i];
- }
- for (var i = 3; i < memory.length; ++i) {
- if (memory[i] != 0)
- throw "Error: Bad value at memory[" + i + "]: " + memory[i];
- }
- debug("Test passed!");
-
- if (window.testRunner)
- testRunner.notifyDone();
-}
-
-startWorker("simple-worker-1.js");
-startWorker("simple-worker-2.js");
-
-</script>
-</body>
-</html>
Modified: branches/safari-603-branch/Source/WebCore/ChangeLog (212525 => 212526)
--- branches/safari-603-branch/Source/WebCore/ChangeLog 2017-02-17 05:28:00 UTC (rev 212525)
+++ branches/safari-603-branch/Source/WebCore/ChangeLog 2017-02-17 05:28:03 UTC (rev 212526)
@@ -1,5 +1,23 @@
2017-02-16 Matthew Hanson <[email protected]>
+ Merge r212301. rdar://problem/30494674
+
+ 2017-02-13 Filip Pizlo <[email protected]>
+
+ worker.postMessage should throw a TypeError if a SharedArrayBuffer is in the transfer list
+ https://bugs.webkit.org/show_bug.cgi?id=168277
+
+ Reviewed by Mark Lam.
+
+ Test: workers/sab/postMessage-transfer-type-error.html
+
+ This is a simple spec compliance change. The title says it all.
+
+ * bindings/js/SerializedScriptValue.cpp:
+ (WebCore::SerializedScriptValue::create):
+
+2017-02-16 Matthew Hanson <[email protected]>
+
Merge r212260. rdar://problem/30481079
2017-02-13 Simon Fraser <[email protected]>
Modified: branches/safari-603-branch/Source/WebCore/bindings/js/SerializedScriptValue.cpp (212525 => 212526)
--- branches/safari-603-branch/Source/WebCore/bindings/js/SerializedScriptValue.cpp 2017-02-17 05:28:00 UTC (rev 212525)
+++ branches/safari-603-branch/Source/WebCore/bindings/js/SerializedScriptValue.cpp 2017-02-17 05:28:03 UTC (rev 212526)
@@ -2759,6 +2759,8 @@
if (auto arrayBuffer = toPossiblySharedArrayBuffer(transferable.get())) {
if (arrayBuffer->isNeutered())
return Exception { DATA_CLONE_ERR };
+ if (arrayBuffer->isShared())
+ return Exception { TypeError };
arrayBuffers.append(WTFMove(arrayBuffer));
continue;
}
