Attachment 341147 Details for Bug 185927 – Patch

[patch] Patch

bug-185927-20180523165909.patch (text/plain), 3.30 KB, created by Keith Miller on 2018-05-23 16:59:09 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2018-05-23 16:59:09 PDT

Size: 3.30 KB

patch

obsolete

>Subversion Revision: 232134
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 217fdeba41a6862304a864f52518729a268d2c50..1244abdf5528400d6ce01ee2bdcf0e95011b35c2 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-05-23  Keith Miller  <keith_miller@apple.com>
>+
>+        Define length on CoW array should properly convert to writable
>+        https://bugs.webkit.org/show_bug.cgi?id=185927
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/JSArray.cpp:
>+        (JSC::JSArray::setLength):
>+
> 2018-05-23  Keith Miller  <keith_miller@apple.com>
> 
>         InPlaceAbstractState should filter variables at the tail from a GetLocal by their flush format
>diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
>index ba1819f30a6095934d9add0adbb222244d01887b..a52ceca13ea2efd8c76c5b8d67b342b3eeff0243 100644
>--- a/Source/JavaScriptCore/runtime/JSArray.cpp
>+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
>@@ -568,7 +568,7 @@ bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException
>     auto scope = DECLARE_THROW_SCOPE(vm);
> 
>     Butterfly* butterfly = this->butterfly();
>-    switch (indexingType()) {
>+    switch (indexingMode()) {
>     case ArrayClass:
>         if (!newLength)
>             return true;
>@@ -581,6 +581,15 @@ bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException
>         createInitialUndecided(vm, newLength);
>         return true;
> 
>+    case CopyOnWriteArrayWithInt32:
>+    case CopyOnWriteArrayWithDouble:
>+    case CopyOnWriteArrayWithContiguous:
>+        if (newLength == butterfly->publicLength())
>+            return true;
>+        convertFromCopyOnWrite(vm);
>+        butterfly = this->butterfly();
>+        FALLTHROUGH;
>+
>     case ArrayWithUndecided:
>     case ArrayWithInt32:
>     case ArrayWithDouble:
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 784e3df9ba54b7ec62069fc173774dd7ddd1ccb4..ac5fc8c098fae7c9098bcfb59ad39e0b42380fb0 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-05-23  Keith Miller  <keith_miller@apple.com>
>+
>+        Define length on CoW array should properly convert to writable
>+        https://bugs.webkit.org/show_bug.cgi?id=185927
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/cow-define-length-as-value.js: Added.
>+        (test):
>+
> 2018-05-23  Michael Saboff  <msaboff@apple.com>
> 
>         Date.parse() doesn't properly handle input outside of ES Spec limits
>diff --git a/JSTests/stress/cow-define-length-as-value.js b/JSTests/stress/cow-define-length-as-value.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..0de9fcd86db8541eaf8e5bb21eee50aca9a79cdb
>--- /dev/null
>+++ b/JSTests/stress/cow-define-length-as-value.js
>@@ -0,0 +1,19 @@
>+function test(create) {
>+    // Set length to be smaller.
>+    Object.defineProperty(create(), "length", { value: 1 });
>+
>+    // Set length to be bigger.
>+    Object.defineProperty(create(), "length", { value: 4 });
>+
>+    // Set length to be the same size
>+    Object.defineProperty(create(), "length", { value: 3 });
>+}
>+
>+// Test Int32.
>+test(() => [1, 2]);
>+// Test double
>+test(() => [1.123, 2.50934]);
>+// Test contiguous via NaN
>+test(() => [NaN, 2.50934]);
>+// Test contiguous via string
>+test(() => ["test", "42"]);

Flags:

ysuzuki: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 185927: 341147