WebKit Bugzilla
Attachment 342364 Details for
Bug 186458
: [JSC] Array.prototype.sort should rejects null comparator
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-186458-20180609184109.patch (text/plain), 5.80 KB, created by
Yusuke Suzuki
on 2018-06-09 02:41:10 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Yusuke Suzuki
Created:
2018-06-09 02:41:10 PDT
Size:
5.80 KB
patch
obsolete
>Subversion Revision: 232659 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index 2ca6c4dc4f5cccaf0f48c31912e73b0dc2411672..1be025550c0d027aa566b29bd08a66468a5f8b7b 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,20 @@ >+2018-06-09 Yusuke Suzuki <utatane.tea@gmail.com> >+ >+ [JSC] Array.prototype.sort should rejects null comparator >+ https://bugs.webkit.org/show_bug.cgi?id=186458 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ This relaxed behavior is once introduced in r216169 to fix some pages by aligning >+ the behavior to Chrome and Firefox. >+ >+ However, now Chrome, Firefox and Edge reject a null comparator. So only JavaScriptCore >+ accepts it. This patch reverts r216169 to align JSC to the other engines and fix >+ the spec issue. >+ >+ * builtins/ArrayPrototype.js: >+ (sort): >+ > 2018-06-08 Wenson Hsieh <wenson_hsieh@apple.com> > > [WebKit on watchOS] Upstream watchOS source additions to OpenSource (Part 1) >diff --git a/Source/JavaScriptCore/builtins/ArrayPrototype.js b/Source/JavaScriptCore/builtins/ArrayPrototype.js >index e6d4f104a2a55b52e46602768cfcf50276a3718f..8a29ed0287257fc47715ac2b6142d68bc079e5a7 100644 >--- a/Source/JavaScriptCore/builtins/ArrayPrototype.js >+++ b/Source/JavaScriptCore/builtins/ArrayPrototype.js >@@ -602,7 +602,7 @@ function stringSort(array, length) > > if (typeof comparator == "function") > comparatorSort(array, length, comparator); >- else if (comparator === null || comparator === @undefined) >+ else if (comparator === @undefined) > stringSort(array, length); > else > @throwTypeError("Array.prototype.sort requires the comparsion function be a function or undefined"); >diff --git a/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc b/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc >index 6ddc09897e09eddf440055724c21acbf6ec4423d..885663a97dfbbe035074ef0a7d1024a7c4ab7544 100644 >--- a/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc >+++ b/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc >@@ -7,4 +7,5 @@ for,sample,some,strings,testing - Output different in cscript due to NaN > 1,2,3 > 10 > 1,1.2,4,4.8,12 >+TypeError: Array.prototype.sort requires the comparsion function be a function or undefined > 1,2,3 >diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog >index 64119c9eaf9c0a8ffa0a4073c802b1c8e71ad37e..6704ee70cd70246cb8f4405b2efe1787f66e583a 100644 >--- a/JSTests/ChangeLog >+++ b/JSTests/ChangeLog >@@ -1,3 +1,16 @@ >+2018-06-09 Yusuke Suzuki <utatane.tea@gmail.com> >+ >+ [JSC] Array.prototype.sort should rejects null comparator >+ https://bugs.webkit.org/show_bug.cgi?id=186458 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * ChakraCore/test/Array/array_sort.baseline-jsc: >+ * stress/array-sort-bad-comparator.js: >+ (test): >+ * stress/sort-null-comparator.js: Removed. >+ * test262/expectations.yaml: >+ > 2018-06-07 Saam Barati <sbarati@apple.com> > > Make DFG to FTL OSR entry code more sane by removing bad RELEASE_ASSERTS and making it trigger compiles in outer loops before inner ones >diff --git a/JSTests/stress/array-sort-bad-comparator.js b/JSTests/stress/array-sort-bad-comparator.js >index 0d9b27cc5448b058dea02d268f40b045b8912e3b..c08203ae26ef6a2e2af51d7b2e74e1254fbc9b23 100644 >--- a/JSTests/stress/array-sort-bad-comparator.js >+++ b/JSTests/stress/array-sort-bad-comparator.js >@@ -1,10 +1,14 @@ > //@ runDefault > > function test() { >+ try { >+ [1,2].sort(null); >+ return false; >+ } catch (enull) {} > try { > [1,2].sort(true); > return false; >- } catch (etrue) {} >+ } catch (etrue) {} > try { > [1,2].sort({}); > return false; >diff --git a/JSTests/stress/sort-null-comparator.js b/JSTests/stress/sort-null-comparator.js >deleted file mode 100644 >index 47398f08caa800c7df9178dc6e6424a14631ac86..0000000000000000000000000000000000000000 >--- a/JSTests/stress/sort-null-comparator.js >+++ /dev/null >@@ -1,10 +0,0 @@ >-// While this is not required by the spec. It looks like some websites rely on the comparator being null. >- >-function assertEq(a, b) { >- if (a !== b) >- throw new Error(); >-} >- >-let array = [2,1].sort(null); >-assertEq(array[0], 1); >-assertEq(array[1], 2); >diff --git a/JSTests/test262/expectations.yaml b/JSTests/test262/expectations.yaml >index 34ece818c2c8e0eda5db2fe1b5cc1b13c017a37f..769122dc81e1b8d6a832d7cbe82f42b6659d481d 100644 >--- a/JSTests/test262/expectations.yaml >+++ b/JSTests/test262/expectations.yaml >@@ -705,9 +705,6 @@ test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js: > test/built-ins/Array/prototype/sort/S15.4.4.11_A4_T3.js: > default: 'Test262Error: #3: var obj = {}; obj.sort = Array.prototype.sort; obj[0] = "z"; obj[1] = "y"; obj[2] = "x"; obj.length = -4294967294; obj.sort(); obj[0] === "z". Actual: y' > strict mode: 'Test262Error: #3: var obj = {}; obj.sort = Array.prototype.sort; obj[0] = "z"; obj[1] = "y"; obj[2] = "x"; obj.length = -4294967294; obj.sort(); obj[0] === "z". Actual: y' >-test/built-ins/Array/prototype/sort/comparefn-nonfunction-call-throws.js: >- default: 'Test262Error: sample.sort(null); Expected a TypeError to be thrown but no exception was thrown at all' >- strict mode: 'Test262Error: sample.sort(null); Expected a TypeError to be thrown but no exception was thrown at all' > test/built-ins/Array/prototype/splice/S15.4.4.12_A3_T1.js: > default: 'Test262Error: #1: var obj = {}; obj.splice = Array.prototype.splice; obj[0] = "x"; obj[4294967295] = "y"; obj.length = 4294967296; var arr = obj.splice(4294967295,1); arr.length === 1. Actual: 0' > strict mode: 'Test262Error: #1: var obj = {}; obj.splice = Array.prototype.splice; obj[0] = "x"; obj[4294967295] = "y"; obj.length = 4294967296; var arr = obj.splice(4294967295,1); arr.length === 1. Actual: 0'
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 186458
: 342364