Title: [270371] trunk
- Revision
- 270371
- Author
- [email protected]
- Date
- 2020-12-02 14:57:13 -0800 (Wed, 02 Dec 2020)
Log Message
%TypedArray%#slice shouldn't care about source buffer detachment if there's nothing to copy
https://bugs.webkit.org/show_bug.cgi?id=219451
Reviewed by Yusuke Suzuki.
JSTests:
* test262/expectations.yaml:
Mark four test cases as passing.
Source/_javascript_Core:
>From https://tc39.es/ecma262/#sec-%typedarray%.prototype.slice:
13. Let A be ? TypedArraySpeciesCreate(O, « 𝔽(count) »).
14. If count > 0, then
a. If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
...
15. Return A.
We had step 14.a raised above 14; this patch fixes the ordering.
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncSlice):
Modified Paths
Diff
Modified: trunk/JSTests/ChangeLog (270370 => 270371)
--- trunk/JSTests/ChangeLog 2020-12-02 22:56:10 UTC (rev 270370)
+++ trunk/JSTests/ChangeLog 2020-12-02 22:57:13 UTC (rev 270371)
@@ -1,3 +1,13 @@
+2020-12-02 Ross Kirsling <[email protected]>
+
+ %TypedArray%#slice shouldn't care about source buffer detachment if there's nothing to copy
+ https://bugs.webkit.org/show_bug.cgi?id=219451
+
+ Reviewed by Yusuke Suzuki.
+
+ * test262/expectations.yaml:
+ Mark four test cases as passing.
+
2020-12-02 Dmitry Bezhetskov <[email protected]>
[WASM-References] Add support for active mods in element section
Modified: trunk/JSTests/test262/expectations.yaml (270370 => 270371)
--- trunk/JSTests/test262/expectations.yaml 2020-12-02 22:56:10 UTC (rev 270370)
+++ trunk/JSTests/test262/expectations.yaml 2020-12-02 22:57:13 UTC (rev 270371)
@@ -832,12 +832,6 @@
test/built-ins/TypedArray/prototype/includes/detached-buffer-tointeger.js:
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-other-targettype.js:
- default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
- strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-same-targettype.js:
- default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
- strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
test/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-detachbuffer.js:
default: 'Test262Error: Expected a TypeError but got a RangeError (Testing with Float64Array.)'
strict mode: 'Test262Error: Expected a TypeError but got a RangeError (Testing with Float64Array.)'
Modified: trunk/Source/_javascript_Core/ChangeLog (270370 => 270371)
--- trunk/Source/_javascript_Core/ChangeLog 2020-12-02 22:56:10 UTC (rev 270370)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-12-02 22:57:13 UTC (rev 270371)
@@ -1,3 +1,22 @@
+2020-12-02 Ross Kirsling <[email protected]>
+
+ %TypedArray%#slice shouldn't care about source buffer detachment if there's nothing to copy
+ https://bugs.webkit.org/show_bug.cgi?id=219451
+
+ Reviewed by Yusuke Suzuki.
+
+ From https://tc39.es/ecma262/#sec-%typedarray%.prototype.slice:
+ 13. Let A be ? TypedArraySpeciesCreate(O, « 𝔽(count) »).
+ 14. If count > 0, then
+ a. If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+ ...
+ 15. Return A.
+
+ We had step 14.a raised above 14; this patch fixes the ordering.
+
+ * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+ (JSC::genericTypedArrayViewProtoFuncSlice):
+
2020-12-02 Dmitry Bezhetskov <[email protected]>
[WASM-References] Add support for active mods in element section
Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (270370 => 270371)
--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2020-12-02 22:56:10 UTC (rev 270370)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2020-12-02 22:57:13 UTC (rev 270371)
@@ -452,15 +452,15 @@
return ViewClass::createUninitialized(globalObject, structure, length);
});
RETURN_IF_EXCEPTION(scope, encodedJSValue());
-
ASSERT(!result->isDetached());
- if (thisObject->isDetached())
- return throwVMTypeError(globalObject, scope, typedArrayBufferHasBeenDetachedErrorMessage);
// We return early here since we don't allocate a backing store if length is 0 and memmove does not like nullptrs
if (!length)
return JSValue::encode(result);
+ if (thisObject->isDetached())
+ return throwVMTypeError(globalObject, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
// The species constructor may return an array with any arbitrary length.
if (result->length() < length)
return throwVMTypeError(globalObject, scope, "TypedArray.prototype.slice constructed typed array of insufficient length"_s);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
