Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8496050f97ee2ef07bd330b6a49220ed3b93d95c
https://github.com/WebKit/WebKit/commit/8496050f97ee2ef07bd330b6a49220ed3b93d95c
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
A JSTests/stress/typedarray-construct-from-array-mutated-by-tonumber.js
M JSTests/test262/expectations-linux.yaml
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/runtime/JSArray.cpp
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h
Log Message:
-----------
[JSC] TypedArray constructor needs to copy JSArray content when its copying
may cause side-effect
https://bugs.webkit.org/show_bug.cgi?id=322954
rdar://186227333
Reviewed by Yijia Huang.
When constructing a TypedArray from JSArray, we need to copy and convert
the content for the array, which invokes ToNumber operation. And it can
be observable when JSArray is Contiguous or ArrayStorage. In this case,
they may hold an object which has valueOf override and that function can
modify the JSArray. According to the spec, we first need to preserve all
the content of JSArray and then doing ToNumber for each element. Thus we
first need to preserve them somewhere. This patch fixes it by copying
them to MarkedArgumentBuffer first when necessary.
Test: JSTests/stress/typedarray-construct-from-array-mutated-by-tonumber.js
* JSTests/stress/typedarray-construct-from-array-mutated-by-tonumber.js: Added.
(shouldBe):
(shrinkWhileConverting):
(overwriteWhileConverting):
(growWhileConverting):
(shrinkWhileConvertingBigInt):
* JSTests/test262/expectations-linux.yaml:
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::JSArray::fillArgList):
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewFromList):
(JSC::constructGenericTypedArrayViewFromIterator):
(JSC::constructGenericTypedArrayViewFromFastArray):
(JSC::constructGenericTypedArrayViewWithArguments):
Canonical link: https://commits.webkit.org/320185@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
