Attachment 282994 Details for Bug 159505 – Patch

[patch] Patch

bug-159505-20160706233807.patch (text/plain), 8.12 KB, created by Benjamin Poulain on 2016-07-06 23:38:40 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Benjamin Poulain

Created: 2016-07-06 23:38:40 PDT

Size: 8.12 KB

patch

obsolete

>Subversion Revision: 202890
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 172932bb6c8db330cbdfea529445e33fe62e7a8a..61810842b63df9bde23a8817a644e0c71eceaba2 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,5 +1,20 @@
> 2016-07-06  Benjamin Poulain  <benjamin@webkit.org>
> 
>+        [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
>+        https://bugs.webkit.org/show_bug.cgi?id=159505
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        The code was using (value)|0 which is effectively a ToInt32.
>+        This fails on large integers and +-Infinity.
>+
>+        Spec: https://tc39.github.io/ecma262/#sec-array.prototype.includes
>+
>+        * builtins/ArrayPrototype.js:
>+        (includes):
>+
>+2016-07-06  Benjamin Poulain  <benjamin@webkit.org>
>+
>         [JSC] Array.prototype[unscopables] should have the "includes" property
>         https://bugs.webkit.org/show_bug.cgi?id=159504
> 
>diff --git a/Source/JavaScriptCore/builtins/ArrayPrototype.js b/Source/JavaScriptCore/builtins/ArrayPrototype.js
>index b5d3222bc2fb9eccc0c2ac20bba9327afb064e91..e00d5037ab6c1606a1aa4d966ffd5026a3728c75 100644
>--- a/Source/JavaScriptCore/builtins/ArrayPrototype.js
>+++ b/Source/JavaScriptCore/builtins/ArrayPrototype.js
>@@ -434,7 +434,7 @@ function includes(searchElement /*, fromIndex*/)
> 
>     var fromIndex = 0;
>     if (arguments.length > 1 && arguments[1] !== @undefined)
>-        fromIndex = arguments[1] | 0;
>+        fromIndex = @toInteger(arguments[1]);
> 
>     var index;
>     if (fromIndex >= 0)
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 8c5ae42cc00d4c8535e73c47ddaf8280032dd785..7e4809d617ea0cc8af58c62a7eb69de947082974 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,5 +1,15 @@
> 2016-07-06  Benjamin Poulain  <benjamin@webkit.org>
> 
>+        [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
>+        https://bugs.webkit.org/show_bug.cgi?id=159505
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * js/array-includes-expected.txt:
>+        * js/script-tests/array-includes.js:
>+
>+2016-07-06  Benjamin Poulain  <benjamin@webkit.org>
>+
>         [JSC] Array.prototype[unscopables] should have the "includes" property
>         https://bugs.webkit.org/show_bug.cgi?id=159504
> 
>diff --git a/LayoutTests/js/array-includes-expected.txt b/LayoutTests/js/array-includes-expected.txt
>index 7e24cae6ec445b5ce525a01287f026607c95f509..21126d5b57c203ff8d21dd2714ef05ded61702b5 100644
>--- a/LayoutTests/js/array-includes-expected.txt
>+++ b/LayoutTests/js/array-includes-expected.txt
>@@ -34,6 +34,37 @@ Array-like object with invalid lengths
> PASS var obj = { 0: 1, 1: 1, 2: 1, length: 0 }; Array.prototype.includes.call(obj, 1) is false
> PASS var obj = { 0: 1, 1: 1, 2: 1, length: -0 }; Array.prototype.includes.call(obj, 1) is false
> PASS var obj = { 0: 1, 1: 1, 2: 1, length: -3 }; Array.prototype.includes.call(obj, 1) is false
>+The index is converted to integer
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, NaN) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, NaN) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, NaN) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Infinity) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Infinity) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Infinity) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, -Infinity) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, -Infinity) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, -Infinity) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER + 1) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER + 1) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER + 1) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER - 1) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER - 1) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER - 1) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, { valueOf: () => { return 1; } }) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, { valueOf: () => { return 1; } }) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, { valueOf: () => { return 1; } }) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, { toString: () => { return '1'; } }) is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, { toString: () => { return '1'; } }) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, { toString: () => { return '1'; } }) is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(2, '1') is false
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(7, '1') is true
>+PASS [2, 3, 5, 7, 11, 13, 17].includes(17, '1') is true
> PASS successfullyParsed is true
> 
> TEST COMPLETE
>diff --git a/LayoutTests/js/script-tests/array-includes.js b/LayoutTests/js/script-tests/array-includes.js
>index 1f5cd908f919e523bcb314e52ccef4557112e919..4d3d4d3acdbff10f812e645d86164125de6ac0f3 100644
>--- a/LayoutTests/js/script-tests/array-includes.js
>+++ b/LayoutTests/js/script-tests/array-includes.js
>@@ -47,3 +47,38 @@ debug("Array-like object with invalid lengths");
> shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: 0 }; Array.prototype.includes.call(obj, 1)");
> shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: -0 }; Array.prototype.includes.call(obj, 1)");
> shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: -3 }; Array.prototype.includes.call(obj, 1)");
>+
>+debug("The index is converted to integer");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, NaN)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, NaN)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, NaN)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Infinity)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Infinity)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Infinity)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, -Infinity)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, -Infinity)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, -Infinity)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER + 1)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER + 1)");
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER + 1)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER - 1)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER - 1)");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER - 1)");
>+
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, { valueOf: () => { return 1; } })");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, { valueOf: () => { return 1; } })");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, { valueOf: () => { return 1; } })");
>+
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, { toString: () => { return '1'; } })");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, { toString: () => { return '1'; } })");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, { toString: () => { return '1'; } })");
>+
>+shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, '1')");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, '1')");
>+shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, '1')");

Actions: View | Formatted Diff | Diff

Attachments on bug 159505: 282994