Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c8c37314ee17807d8d77e157e983f54872b103ab
https://github.com/WebKit/WebKit/commit/c8c37314ee17807d8d77e157e983f54872b103ab
Author: itsu-dev <[email protected]>
Date: 2026-09-05 (Sat, 05 Sep 2026)
Changed paths:
M JSTests/stress/change-array-by-copy.js
M Source/JavaScriptCore/runtime/ArrayPrototype.cpp
Log Message:
-----------
[JSC] Array.prototype.toSpliced incorrectly throws TypeError instead of
RangeError when length is Infinity
https://bugs.webkit.org/show_bug.cgi?id=320830
Reviewed by Yusuke Suzuki.
Array.prototype.toSpliced should throw TypeError when the new array
length exceeds 2**53-1 (Step 12 of [1]), but it currently throws
TypeError for the length of 2**53-1. For this case, it should throw
RangeError instead (Step 13 of [1], Step 1 of [2]).
To fix this, this commit replaces `>=` with `>` in the implementation
of `Array.prototype.toSpliced` to check the new array length.
[1]:
https://tc39.es/ecma262/2026/multipage/indexed-collections.html#sec-array.prototype.tospliced
[2]:
https://tc39.es/ecma262/2026/multipage/ordinary-and-exotic-objects-behaviours.html#sec-arraycreate
No additional tests. Instead, this commit also modify a exisiting
stress test to adjust the specification.
* JSTests/stress/change-array-by-copy.js:
(shouldThrow):
* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/320554@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
