Diff
Modified: trunk/JSTests/ChangeLog (263215 => 263216)
--- trunk/JSTests/ChangeLog 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/JSTests/ChangeLog 2020-06-18 17:10:29 UTC (rev 263216)
@@ -1,3 +1,12 @@
+2020-06-18 Alexey Shvayka <shvaikal...@gmail.com>
+
+ TypedArray.prototype.set is incorrect with primitives
+ https://bugs.webkit.org/show_bug.cgi?id=212730
+
+ Reviewed by Yusuke Suzuki.
+
+ * test262/expectations.yaml: Mark 2 test cases as passing.
+
2020-06-17 Saam Barati <sbar...@apple.com>
Skip JSTests/stress/check-is-constant-non-cell-should-not-array-profile-during-osr-exit.js on memory limited devices
Modified: trunk/JSTests/test262/expectations.yaml (263215 => 263216)
--- trunk/JSTests/test262/expectations.yaml 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/JSTests/test262/expectations.yaml 2020-06-18 17:10:29 UTC (rev 263216)
@@ -1509,9 +1509,6 @@
test/built-ins/TypedArray/prototype/map/speciesctor-get-species-custom-ctor-length-throws.js:
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/set/array-arg-primitive-toobject.js:
- default: 'TypeError: First argument should be an object (Testing with Float64Array.)'
- strict mode: 'TypeError: First argument should be an object (Testing with Float64Array.)'
test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-other-targettype.js:
default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
Modified: trunk/LayoutTests/ChangeLog (263215 => 263216)
--- trunk/LayoutTests/ChangeLog 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/LayoutTests/ChangeLog 2020-06-18 17:10:29 UTC (rev 263216)
@@ -1,3 +1,14 @@
+2020-06-18 Alexey Shvayka <shvaikal...@gmail.com>
+
+ TypedArray.prototype.set is incorrect with primitives
+ https://bugs.webkit.org/show_bug.cgi?id=212730
+
+ Reviewed by Yusuke Suzuki.
+
+ * fast/canvas/webgl/array-get-and-set-method-removal-expected.txt:
+ * fast/canvas/webgl/array-get-and-set-method-removal.html:
+ * fast/canvas/webgl/array-set-invalid-arguments-expected.txt:
+
2020-06-18 Diego Pino Garcia <dp...@igalia.com>
[GTK] Unreviewed test gardening. Update test expectations after r263207.
Modified: trunk/LayoutTests/fast/canvas/webgl/array-get-and-set-method-removal-expected.txt (263215 => 263216)
--- trunk/LayoutTests/fast/canvas/webgl/array-get-and-set-method-removal-expected.txt 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/LayoutTests/fast/canvas/webgl/array-get-and-set-method-removal-expected.txt 2020-06-18 17:10:29 UTC (rev 263216)
@@ -4,19 +4,33 @@
Regression test for https://bugs.webkit.org/show_bug.cgi?id=38039
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS webGLArray.get is undefined.
-PASS webGLArray.set(0, 1) threw exception.
+PASS webGLArray[0] is 2
+PASS webGLArray[1] is 3
+PASS webGLArray.set(0, 1) is noop
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/fast/canvas/webgl/array-get-and-set-method-removal.html (263215 => 263216)
--- trunk/LayoutTests/fast/canvas/webgl/array-get-and-set-method-removal.html 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/LayoutTests/fast/canvas/webgl/array-get-and-set-method-removal.html 2020-06-18 17:10:29 UTC (rev 263216)
@@ -13,7 +13,7 @@
debug('Regression test for <a href=""
-// Global scope so shouldThrow can see it
+// Global scope so shouldBe* can see it
var webGLArray;
function negativeTestGetAndSetMethods(typeName) {
@@ -20,21 +20,11 @@
var type = window[typeName];
webGLArray = new type([2, 3]);
shouldBeUndefined("webGLArray.get");
- var exceptionThrown = false;
- // We deliberately check for an exception here rather than using
- // shouldThrow here because the precise contents of the syntax
- // error are not specified.
- try {
- webGLArray.set(0, 1);
- } catch (e) {
- exceptionThrown = true;
- }
- var output = "webGLArray.set(0, 1) ";
- if (exceptionThrown) {
- testPassed(output + "threw exception.");
- } else {
- testFailed(output + "did not throw exception.");
- }
+
+ webGLArray.set(0, 1);
+ shouldBe("webGLArray[0]", "2");
+ shouldBe("webGLArray[1]", "3");
+ testPassed("webGLArray.set(0, 1) is noop");
}
negativeTestGetAndSetMethods("Int8Array");
Modified: trunk/LayoutTests/fast/canvas/webgl/array-set-invalid-arguments-expected.txt (263215 => 263216)
--- trunk/LayoutTests/fast/canvas/webgl/array-set-invalid-arguments-expected.txt 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/LayoutTests/fast/canvas/webgl/array-set-invalid-arguments-expected.txt 2020-06-18 17:10:29 UTC (rev 263216)
@@ -3,25 +3,25 @@
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set() threw exception TypeError: Expected at least one argument.
-PASS typedArray.set('hello world') threw exception TypeError: First argument should be an object.
+PASS typedArray.set('hello world') threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS typedArray.set(otherArray, 1) threw exception RangeError: Range consisting of offset and length are out of bounds.
PASS successfullyParsed is true
Modified: trunk/Source/_javascript_Core/ChangeLog (263215 => 263216)
--- trunk/Source/_javascript_Core/ChangeLog 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-06-18 17:10:29 UTC (rev 263216)
@@ -1,3 +1,19 @@
+2020-06-18 Alexey Shvayka <shvaikal...@gmail.com>
+
+ TypedArray.prototype.set is incorrect with primitives
+ https://bugs.webkit.org/show_bug.cgi?id=212730
+
+ Reviewed by Yusuke Suzuki.
+
+ This change implements step 14 of %TypedArray%.prototype.set [1],
+ which coerces primitives to objects instead of throwing an error,
+ aligning JSC with V8 and SpiderMonkey.
+
+ [1]: https://tc39.es/ecma262/#sec-%typedarray%.prototype.set-array-offset
+
+ * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+ (JSC::genericTypedArrayViewProtoFuncSet):
+
2020-06-17 Mark Lam <mark....@apple.com>
Replace JSC::FreeList linked list with a Bitmap.
Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (263215 => 263216)
--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2020-06-18 17:03:08 UTC (rev 263215)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2020-06-18 17:10:29 UTC (rev 263216)
@@ -123,9 +123,8 @@
if (UNLIKELY(thisObject->isNeutered()))
return throwVMTypeError(globalObject, scope, typedArrayBufferHasBeenDetachedErrorMessage);
- JSObject* sourceArray = jsDynamicCast<JSObject*>(vm, callFrame->uncheckedArgument(0));
- if (UNLIKELY(!sourceArray))
- return throwVMTypeError(globalObject, scope, "First argument should be an object"_s);
+ JSObject* sourceArray = callFrame->uncheckedArgument(0).toObject(globalObject);
+ RETURN_IF_EXCEPTION(scope, { });
unsigned length;
if (isTypedView(sourceArray->classInfo(vm)->typedArrayStorageType)) {
