Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9654ed7d9e3db5a2d34b5b0de7e6ba054cd53dd5
https://github.com/WebKit/WebKit/commit/9654ed7d9e3db5a2d34b5b0de7e6ba054cd53dd5
Author: Sosuke Suzuki <[email protected]>
Date: 2026-03-26 (Thu, 26 Mar 2026)
Changed paths:
M JSTests/stress/reflect-set.js
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
M Source/JavaScriptCore/runtime/JSObject.cpp
Log Message:
-----------
[JSC] TypedArray `[[Set]]` should check receiver before writing to typed array
https://bugs.webkit.org/show_bug.cgi?id=310457
Reviewed by Yusuke Suzuki.
Implement the receiver check in TypedArray [[Set]] introduced by
https://github.com/tc39/ecma262/pull/1556. When Receiver differs from
the typed array, we should fall back to OrdinarySet for valid indices
and return true without coercion for invalid indices.
This is the indexed [[Set]] follow-up to Bug 217916, which fixed
non-index property names.
1. JSGenericTypedArrayView::put checks isThisValueAltered and falls
back to ordinarySetSlow for valid indices, or returns true for
invalid indices.
2. ordinarySetWithOwnDescriptor delegates to the typed array's put
when found in the prototype chain.
3. attemptToInterceptPutByIndexOnHoleForPrototype stops walking at
a typed array, intercepting invalid indices and letting the caller
write to the receiver for valid indices.
Also update JSTests/stress/reflect-set.js to the new spec behavior.
* JSTests/stress/reflect-set.js:
(set get Uint8Array):
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::put):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::ordinarySetWithOwnDescriptor):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
Canonical link: https://commits.webkit.org/309967@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
