Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d3b43220734e87c869665cd41a495586acf9e274
https://github.com/WebKit/WebKit/commit/d3b43220734e87c869665cd41a495586acf9e274
Author: Yijia Huang <[email protected]>
Date: 2023-12-13 (Wed, 13 Dec 2023)
Changed paths:
M Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
Log Message:
-----------
REGRESSION (270691@main): test262
test/built-ins/TypedArray/prototype/sort/sort-tonumber.js: Underlying
ArrayBuffer has been detached from the view or out-of-bounds
https://bugs.webkit.org/show_bug.cgi?id=266245
rdar://119506259
Reviewed by Yusuke Suzuki.
There is no need to to check detached buffer and throw TypeError
after comparator function being executed for %TypedArray%.prototype.sort.
See steps 6-10 in [1].
[1] https://tc39.es/ecma262/#sec-%typedarray%.prototype.sort
* Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h:
(JSC::validateTypedArray):
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncSortImpl):
(JSC::genericTypedArrayViewProtoFuncSort):
Canonical link: https://commits.webkit.org/271988@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
