Title: [267549] trunk
- Revision
- 267549
- Author
- [email protected]
- Date
- 2020-09-24 15:05:31 -0700 (Thu, 24 Sep 2020)
Log Message
JSTests:
%TypedArray%.prototype.{map, filter} should perform TypedArraySpeciesCreate correctly
https://bugs.webkit.org/show_bug.cgi?id=216938
Reviewed by Yusuke Suzuki.
* stress/typedarray-slice.js:
Fix test.
* test262/expectations.yaml:
Mark ten test cases as passing.
Source/_javascript_Core:
%TypedArray% methods should perform TypedArraySpeciesCreate correctly
https://bugs.webkit.org/show_bug.cgi?id=216938
Reviewed by Yusuke Suzuki.
map, filter, and slice are obliged to throw when:
1. this.constructor is defined but not an object
2. the species constructor produces a valid typed array which is shorter than the expected length
* builtins/TypedArrayPrototype.js:
(map):
(filter):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncSlice):
Modified Paths
Diff
Modified: trunk/JSTests/ChangeLog (267548 => 267549)
--- trunk/JSTests/ChangeLog 2020-09-24 21:59:37 UTC (rev 267548)
+++ trunk/JSTests/ChangeLog 2020-09-24 22:05:31 UTC (rev 267549)
@@ -1,5 +1,18 @@
2020-09-24 Ross Kirsling <[email protected]>
+ %TypedArray%.prototype.{map, filter} should perform TypedArraySpeciesCreate correctly
+ https://bugs.webkit.org/show_bug.cgi?id=216938
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/typedarray-slice.js:
+ Fix test.
+
+ * test262/expectations.yaml:
+ Mark ten test cases as passing.
+
+2020-09-24 Ross Kirsling <[email protected]>
+
%TypedArray%.prototype.fill must only evaluate its argument once
https://bugs.webkit.org/show_bug.cgi?id=216912
Modified: trunk/JSTests/stress/typedarray-slice.js (267548 => 267549)
--- trunk/JSTests/stress/typedarray-slice.js 2020-09-24 21:59:37 UTC (rev 267548)
+++ trunk/JSTests/stress/typedarray-slice.js 2020-09-24 22:05:31 UTC (rev 267549)
@@ -114,6 +114,10 @@
function testSpeciesWithSameBuffer(unused, constructor) {
return typedArrays.every(function(speciesConstructor) {
+ // This test is not valid for all type pairs.
+ if (constructor.BYTES_PER_ELEMENT < speciesConstructor.BYTES_PER_ELEMENT)
+ return true;
+
constructor[Symbol.species] = function() { return new speciesConstructor(buffer); };
let array = new constructor(buffer);
let otherArray = new speciesConstructor(buffer);
Modified: trunk/JSTests/test262/expectations.yaml (267548 => 267549)
--- trunk/JSTests/test262/expectations.yaml 2020-09-24 21:59:37 UTC (rev 267548)
+++ trunk/JSTests/test262/expectations.yaml 2020-09-24 22:05:31 UTC (rev 267549)
@@ -1245,18 +1245,6 @@
strict mode: 'SyntaxError: Invalid regular _expression_: number too large in {} quantifier'
test/built-ins/ThrowTypeError/unique-per-realm-non-simple.js:
default: 'Test262Error: callee.get Expected SameValue(«function () {'
-test/built-ins/TypedArray/prototype/filter/speciesctor-get-ctor-returns-throws.js:
- default: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
- strict mode: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/filter/speciesctor-get-species-custom-ctor-length-throws.js:
- default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
- strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/map/speciesctor-get-ctor-returns-throws.js:
- default: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
- strict mode: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/map/speciesctor-get-species-custom-ctor-length-throws.js:
- default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
- strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-other-targettype.js:
default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
@@ -1263,9 +1251,6 @@
test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-same-targettype.js:
default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/slice/speciesctor-get-species-custom-ctor-length-throws.js:
- default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
- strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
test/built-ins/TypedArray/prototype/sort/comparefn-nonfunction-call-throws.js:
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
Modified: trunk/Source/_javascript_Core/ChangeLog (267548 => 267549)
--- trunk/Source/_javascript_Core/ChangeLog 2020-09-24 21:59:37 UTC (rev 267548)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-09-24 22:05:31 UTC (rev 267549)
@@ -1,3 +1,20 @@
+2020-09-24 Ross Kirsling <[email protected]>
+
+ %TypedArray% methods should perform TypedArraySpeciesCreate correctly
+ https://bugs.webkit.org/show_bug.cgi?id=216938
+
+ Reviewed by Yusuke Suzuki.
+
+ map, filter, and slice are obliged to throw when:
+ 1. this.constructor is defined but not an object
+ 2. the species constructor produces a valid typed array which is shorter than the expected length
+
+ * builtins/TypedArrayPrototype.js:
+ (map):
+ (filter):
+ * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+ (JSC::genericTypedArrayViewProtoFuncSlice):
+
2020-09-24 Basuke Suzuki <[email protected]>
[PlayStation] Stop raising SIGPIPE when client side of RemoteInspector dies
Modified: trunk/Source/_javascript_Core/builtins/TypedArrayPrototype.js (267548 => 267549)
--- trunk/Source/_javascript_Core/builtins/TypedArrayPrototype.js 2020-09-24 21:59:37 UTC (rev 267548)
+++ trunk/Source/_javascript_Core/builtins/TypedArrayPrototype.js 2020-09-24 22:05:31 UTC (rev 267549)
@@ -311,21 +311,10 @@
var thisArg = @argument(1);
- // Do species construction
- var constructor = this.constructor;
- var result;
- if (constructor === @undefined)
- result = new (@typedArrayGetOriginalConstructor(this))(length);
- else {
- var speciesConstructor = constructor.@@species;
- if (@isUndefinedOrNull(speciesConstructor))
- result = new (@typedArrayGetOriginalConstructor(this))(length);
- else {
- result = new speciesConstructor(length);
- // typedArrayLength throws if it doesn't get a view.
- @typedArrayLength(result);
- }
- }
+ var constructor = @typedArraySpeciesConstructor(this);
+ var result = new constructor(length);
+ if (@typedArrayLength(result) < length)
+ @throwTypeError("TypedArray.prototype.map constructed typed array of insufficient length");
for (var i = 0; i < length; i++) {
var mappedValue = callback.@call(thisArg, this[i], i, this);
@@ -351,24 +340,14 @@
if (callback.@call(thisArg, value, i, this))
kept.@push(value);
}
+ var length = kept.length;
- var constructor = this.constructor;
- var result;
- var resultLength = kept.length;
- if (constructor === @undefined)
- result = new (@typedArrayGetOriginalConstructor(this))(resultLength);
- else {
- var speciesConstructor = constructor.@@species;
- if (@isUndefinedOrNull(speciesConstructor))
- result = new (@typedArrayGetOriginalConstructor(this))(resultLength);
- else {
- result = new speciesConstructor(resultLength);
- // typedArrayLength throws if it doesn't get a view.
- @typedArrayLength(result);
- }
- }
+ var constructor = @typedArraySpeciesConstructor(this);
+ var result = new constructor(length);
+ if (@typedArrayLength(result) < length)
+ @throwTypeError("TypedArray.prototype.filter constructed typed array of insufficient length");
- for (var i = 0; i < kept.length; i++)
+ for (var i = 0; i < length; i++)
result[i] = kept[i];
return result;
Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (267548 => 267549)
--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2020-09-24 21:59:37 UTC (rev 267548)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2020-09-24 22:05:31 UTC (rev 267549)
@@ -464,7 +464,9 @@
return JSValue::encode(result);
// The species constructor may return an array with any arbitrary length.
- length = std::min(length, result->length());
+ if (result->length() < length)
+ return throwVMTypeError(globalObject, scope, "TypedArray.prototype.slice constructed typed array of insufficient length"_s);
+
switch (result->classInfo(vm)->typedArrayStorageType) {
case TypeInt8:
scope.release();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
