Title: [267522] trunk
- Revision
- 267522
- Author
- [email protected]
- Date
- 2020-09-24 00:35:30 -0700 (Thu, 24 Sep 2020)
Log Message
%TypedArray%.prototype.fill must only evaluate its argument once
https://bugs.webkit.org/show_bug.cgi?id=216912
Reviewed by Yusuke Suzuki.
JSTests:
* stress/typedarray-fill.js:
Fix test.
* test262/expectations.yaml:
Mark two test cases as passing.
Source/_javascript_Core:
Currently, we evaluate the argument in `typedArray.fill({ valueOf() { ... } })` once per filled element,
but it should only be evaluated once in total.
* builtins/TypedArrayPrototype.js:
(fill):
Modified Paths
Diff
Modified: trunk/JSTests/ChangeLog (267521 => 267522)
--- trunk/JSTests/ChangeLog 2020-09-24 07:10:26 UTC (rev 267521)
+++ trunk/JSTests/ChangeLog 2020-09-24 07:35:30 UTC (rev 267522)
@@ -1,3 +1,16 @@
+2020-09-24 Ross Kirsling <[email protected]>
+
+ %TypedArray%.prototype.fill must only evaluate its argument once
+ https://bugs.webkit.org/show_bug.cgi?id=216912
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/typedarray-fill.js:
+ Fix test.
+
+ * test262/expectations.yaml:
+ Mark two test cases as passing.
+
2020-09-23 Ross Kirsling <[email protected]>
%ArrayIteratorPrototype%.next must check for detached buffers
Modified: trunk/JSTests/stress/typedarray-fill.js (267521 => 267522)
--- trunk/JSTests/stress/typedarray-fill.js 2020-09-24 07:10:26 UTC (rev 267521)
+++ trunk/JSTests/stress/typedarray-fill.js 2020-09-24 07:35:30 UTC (rev 267522)
@@ -41,7 +41,7 @@
return target[name];
}});
new constructor(10).fill(p);
- shouldBeTrue("count === 40");
+ shouldBeTrue("count === 4");
}
Modified: trunk/JSTests/test262/expectations.yaml (267521 => 267522)
--- trunk/JSTests/test262/expectations.yaml 2020-09-24 07:10:26 UTC (rev 267521)
+++ trunk/JSTests/test262/expectations.yaml 2020-09-24 07:35:30 UTC (rev 267522)
@@ -1245,9 +1245,6 @@
strict mode: 'SyntaxError: Invalid regular _expression_: number too large in {} quantifier'
test/built-ins/ThrowTypeError/unique-per-realm-non-simple.js:
default: 'Test262Error: callee.get Expected SameValue(«function () {'
-test/built-ins/TypedArray/prototype/fill/fill-values-conversion-once.js:
- default: 'Test262Error: additional unexpected ToNumber() calls Expected SameValue(«3», «2») to be true (Testing with Float64Array.)'
- strict mode: 'Test262Error: additional unexpected ToNumber() calls Expected SameValue(«3», «2») to be true (Testing with Float64Array.)'
test/built-ins/TypedArray/prototype/filter/speciesctor-get-ctor-returns-throws.js:
default: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
strict mode: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
Modified: trunk/Source/_javascript_Core/ChangeLog (267521 => 267522)
--- trunk/Source/_javascript_Core/ChangeLog 2020-09-24 07:10:26 UTC (rev 267521)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-09-24 07:35:30 UTC (rev 267522)
@@ -1,3 +1,16 @@
+2020-09-24 Ross Kirsling <[email protected]>
+
+ %TypedArray%.prototype.fill must only evaluate its argument once
+ https://bugs.webkit.org/show_bug.cgi?id=216912
+
+ Reviewed by Yusuke Suzuki.
+
+ Currently, we evaluate the argument in `typedArray.fill({ valueOf() { ... } })` once per filled element,
+ but it should only be evaluated once in total.
+
+ * builtins/TypedArrayPrototype.js:
+ (fill):
+
2020-09-23 Ross Kirsling <[email protected]>
%ArrayIteratorPrototype%.next must check for detached buffers
Modified: trunk/Source/_javascript_Core/builtins/TypedArrayPrototype.js (267521 => 267522)
--- trunk/Source/_javascript_Core/builtins/TypedArrayPrototype.js 2020-09-24 07:10:26 UTC (rev 267521)
+++ trunk/Source/_javascript_Core/builtins/TypedArrayPrototype.js 2020-09-24 07:35:30 UTC (rev 267522)
@@ -91,14 +91,13 @@
var length = @typedArrayLength(this);
- var start = @argument(1);
- var end = @argument(2);
+ var number = @toNumber(value);
- start = @typedArrayClampArgumentToStartOrEnd(start, length, 0);
- end = @typedArrayClampArgumentToStartOrEnd(end, length, length);
+ var start = @typedArrayClampArgumentToStartOrEnd(@argument(1), length, 0);
+ var end = @typedArrayClampArgumentToStartOrEnd(@argument(2), length, length);
for (var i = start; i < end; i++)
- this[i] = value;
+ this[i] = number;
return this;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
