Attachment 339969 Details for Bug 185476 – Patch

[patch] Patch

bug-185476-20180509133110.patch (text/plain), 2.23 KB, created by Leo Balter on 2018-05-09 09:31:11 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Leo Balter

Created: 2018-05-09 09:31:11 PDT

Size: 2.23 KB

patch

obsolete

>Subversion Revision: 231554
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 89ab19be86bbc07f525384741d3c9737183ddc48..dda2ed1dec64846d6b7da349371d66d074f9f830 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,20 @@
>+2018-05-09  Leo Balter  <leonardo.balter@gmail.com>
>+
>+        [JSC] Fix ArraySpeciesCreate to return a new Array when the given object is not an array
>+        Error found in the following Test262 tests:
>+
>+        - test/built-ins/Array/prototype/slice/create-non-array-invalid-len.js
>+        - test/built-ins/Array/prototype/slice/create-proxied-array-invalid-len.js
>+        - test/built-ins/Array/prototype/splice/create-species-undef-invalid-len.js
>+
>+        The ArraySpeciesCreate should throw a RangeError with non-Array custom objects
>+        presenting a length > 2**32-1
>+        https://bugs.webkit.org/show_bug.cgi?id=185476
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/ArrayPrototype.cpp:
>+
> 2018-05-09  Srdjan Lazarevic  <srdjan.lazarevic@rt-rk.com>
> 
>         [MIPS] Optimize generated JIT code using r2
>diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>index 3e2843feae1ed344383f69a495540cfbb5a97756..d53125f67cd8bafd8332c34b91e4563d641f4aed 100644
>--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>@@ -247,8 +247,14 @@ static ALWAYS_INLINE std::pair<SpeciesConstructResult, JSObject*> speciesConstru
>             if (constructor.isNull())
>                 return std::make_pair(SpeciesConstructResult::FastPath, nullptr);;
>         }
>-    } else
>+    } else {
>+        // If isArray is false, return ? ArrayCreate(length).
>+        JSGlobalObject* globalObject = thisObject->globalObject();
>+        JSValue newValue = constructArrayWithSizeQuirk(exec, nullptr, globalObject, jsNumber(length), exec->newTarget());
>+        JSObject* newObject = newValue.toObject(exec);
>         RETURN_IF_EXCEPTION(scope, exceptionResult());
>+        return std::make_pair(SpeciesConstructResult::CreatedObject, newObject);
>+    }
> 
>     if (constructor.isUndefined())
>         return std::make_pair(SpeciesConstructResult::FastPath, nullptr);

Actions: View | Formatted Diff | Diff

Attachments on bug 185476: 339969 | 339974 | 339977