Diff
Modified: trunk/JSTests/ChangeLog (218451 => 218452)
--- trunk/JSTests/ChangeLog 2017-06-17 13:02:08 UTC (rev 218451)
+++ trunk/JSTests/ChangeLog 2017-06-17 14:13:13 UTC (rev 218452)
@@ -1,5 +1,14 @@
2017-06-17 Keith Miller <[email protected]>
+ ArrayBuffer constructor needs to create subclass structures before its buffer
+ https://bugs.webkit.org/show_bug.cgi?id=173510
+
+ Reviewed by Yusuke Suzuki.
+
+ * test262.yaml:
+
+2017-06-17 Keith Miller <[email protected]>
+
ArrayPrototype methods should use JSValue::toLength for non-Arrays.
https://bugs.webkit.org/show_bug.cgi?id=173506
Modified: trunk/JSTests/test262.yaml (218451 => 218452)
--- trunk/JSTests/test262.yaml 2017-06-17 13:02:08 UTC (rev 218451)
+++ trunk/JSTests/test262.yaml 2017-06-17 14:13:13 UTC (rev 218452)
@@ -12890,9 +12890,9 @@
- path: test262/test/built-ins/ArrayBuffer/allocation-limit.js
cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], [:strict]
- path: test262/test/built-ins/ArrayBuffer/data-allocation-after-object-creation.js
- cmd: runTest262 :fail, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], []
+ cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], []
- path: test262/test/built-ins/ArrayBuffer/data-allocation-after-object-creation.js
- cmd: runTest262 :fail, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], [:strict]
+ cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], [:strict]
- path: test262/test/built-ins/ArrayBuffer/init-zero.js
cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], []
- path: test262/test/built-ins/ArrayBuffer/init-zero.js
Modified: trunk/Source/_javascript_Core/ChangeLog (218451 => 218452)
--- trunk/Source/_javascript_Core/ChangeLog 2017-06-17 13:02:08 UTC (rev 218451)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-06-17 14:13:13 UTC (rev 218452)
@@ -1,5 +1,15 @@
2017-06-17 Keith Miller <[email protected]>
+ ArrayBuffer constructor needs to create subclass structures before its buffer
+ https://bugs.webkit.org/show_bug.cgi?id=173510
+
+ Reviewed by Yusuke Suzuki.
+
+ * runtime/JSArrayBufferConstructor.cpp:
+ (JSC::constructArrayBuffer):
+
+2017-06-17 Keith Miller <[email protected]>
+
ArrayPrototype methods should use JSValue::toLength for non-Arrays.
https://bugs.webkit.org/show_bug.cgi?id=173506
Modified: trunk/Source/_javascript_Core/runtime/JSArrayBufferConstructor.cpp (218451 => 218452)
--- trunk/Source/_javascript_Core/runtime/JSArrayBufferConstructor.cpp 2017-06-17 13:02:08 UTC (rev 218451)
+++ trunk/Source/_javascript_Core/runtime/JSArrayBufferConstructor.cpp 2017-06-17 14:13:13 UTC (rev 218452)
@@ -87,7 +87,10 @@
JSArrayBufferConstructor* constructor =
jsCast<JSArrayBufferConstructor*>(exec->jsCallee());
-
+
+ Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), constructor->globalObject()->arrayBufferStructure(constructor->sharingMode()));
+ RETURN_IF_EXCEPTION(scope, { });
+
unsigned length;
if (exec->argumentCount()) {
length = exec->uncheckedArgument(0).toIndex(exec, "length");
@@ -98,7 +101,7 @@
// with a zero length.
length = 0;
}
-
+
auto buffer = ArrayBuffer::tryCreate(length, 1);
if (!buffer)
return JSValue::encode(throwOutOfMemoryError(exec, scope));
@@ -105,13 +108,9 @@
if (constructor->sharingMode() == ArrayBufferSharingMode::Shared)
buffer->makeShared();
-
ASSERT(constructor->sharingMode() == buffer->sharingMode());
-
- Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), constructor->globalObject()->arrayBufferStructure(constructor->sharingMode()));
- RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
JSArrayBuffer* result = JSArrayBuffer::create(vm, arrayBufferStructure, WTFMove(buffer));
-
return JSValue::encode(result);
}
