Attachment 342364 Details for Bug 186458 – Patch

[patch] Patch

bug-186458-20180609184109.patch (text/plain), 5.80 KB, created by Yusuke Suzuki on 2018-06-09 02:41:10 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2018-06-09 02:41:10 PDT

Size: 5.80 KB

patch

obsolete

>Subversion Revision: 232659
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 2ca6c4dc4f5cccaf0f48c31912e73b0dc2411672..1be025550c0d027aa566b29bd08a66468a5f8b7b 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,20 @@
>+2018-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
>+
>+        [JSC] Array.prototype.sort should rejects null comparator
>+        https://bugs.webkit.org/show_bug.cgi?id=186458
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This relaxed behavior is once introduced in r216169 to fix some pages by aligning
>+        the behavior to Chrome and Firefox.
>+
>+        However, now Chrome, Firefox and Edge reject a null comparator. So only JavaScriptCore
>+        accepts it. This patch reverts r216169 to align JSC to the other engines and fix
>+        the spec issue.
>+
>+        * builtins/ArrayPrototype.js:
>+        (sort):
>+
> 2018-06-08  Wenson Hsieh  <wenson_hsieh@apple.com>
> 
>         [WebKit on watchOS] Upstream watchOS source additions to OpenSource (Part 1)
>diff --git a/Source/JavaScriptCore/builtins/ArrayPrototype.js b/Source/JavaScriptCore/builtins/ArrayPrototype.js
>index e6d4f104a2a55b52e46602768cfcf50276a3718f..8a29ed0287257fc47715ac2b6142d68bc079e5a7 100644
>--- a/Source/JavaScriptCore/builtins/ArrayPrototype.js
>+++ b/Source/JavaScriptCore/builtins/ArrayPrototype.js
>@@ -602,7 +602,7 @@ function stringSort(array, length)
> 
>     if (typeof comparator == "function")
>         comparatorSort(array, length, comparator);
>-    else if (comparator === null || comparator === @undefined)
>+    else if (comparator === @undefined)
>         stringSort(array, length);
>     else
>         @throwTypeError("Array.prototype.sort requires the comparsion function be a function or undefined");
>diff --git a/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc b/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc
>index 6ddc09897e09eddf440055724c21acbf6ec4423d..885663a97dfbbe035074ef0a7d1024a7c4ab7544 100644
>--- a/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc
>+++ b/JSTests/ChakraCore/test/Array/array_sort.baseline-jsc
>@@ -7,4 +7,5 @@ for,sample,some,strings,testing - Output different in cscript due to NaN
> 1,2,3
> 10
> 1,1.2,4,4.8,12
>+TypeError: Array.prototype.sort requires the comparsion function be a function or undefined
> 1,2,3
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 64119c9eaf9c0a8ffa0a4073c802b1c8e71ad37e..6704ee70cd70246cb8f4405b2efe1787f66e583a 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,16 @@
>+2018-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
>+
>+        [JSC] Array.prototype.sort should rejects null comparator
>+        https://bugs.webkit.org/show_bug.cgi?id=186458
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * ChakraCore/test/Array/array_sort.baseline-jsc:
>+        * stress/array-sort-bad-comparator.js:
>+        (test):
>+        * stress/sort-null-comparator.js: Removed.
>+        * test262/expectations.yaml:
>+
> 2018-06-07  Saam Barati  <sbarati@apple.com>
> 
>         Make DFG to FTL OSR entry code more sane by removing bad RELEASE_ASSERTS and making it trigger compiles in outer loops before inner ones
>diff --git a/JSTests/stress/array-sort-bad-comparator.js b/JSTests/stress/array-sort-bad-comparator.js
>index 0d9b27cc5448b058dea02d268f40b045b8912e3b..c08203ae26ef6a2e2af51d7b2e74e1254fbc9b23 100644
>--- a/JSTests/stress/array-sort-bad-comparator.js
>+++ b/JSTests/stress/array-sort-bad-comparator.js
>@@ -1,10 +1,14 @@
> //@ runDefault
> 
> function test() {
>+    try {
>+        [1,2].sort(null);
>+        return false;
>+        } catch (enull) {}
>     try {
>         [1,2].sort(true);
>         return false;
>-    } catch (etrue) {}
>+        } catch (etrue) {}
>     try {
>         [1,2].sort({});
>         return false;
>diff --git a/JSTests/stress/sort-null-comparator.js b/JSTests/stress/sort-null-comparator.js
>deleted file mode 100644
>index 47398f08caa800c7df9178dc6e6424a14631ac86..0000000000000000000000000000000000000000
>--- a/JSTests/stress/sort-null-comparator.js
>+++ /dev/null
>@@ -1,10 +0,0 @@
>-// While this is not required by the spec. It looks like some websites rely on the comparator being null.
>-
>-function assertEq(a, b) {
>-    if (a !== b)
>-        throw new Error();
>-}
>-
>-let array = [2,1].sort(null);
>-assertEq(array[0], 1);
>-assertEq(array[1], 2);
>diff --git a/JSTests/test262/expectations.yaml b/JSTests/test262/expectations.yaml
>index 34ece818c2c8e0eda5db2fe1b5cc1b13c017a37f..769122dc81e1b8d6a832d7cbe82f42b6659d481d 100644
>--- a/JSTests/test262/expectations.yaml
>+++ b/JSTests/test262/expectations.yaml
>@@ -705,9 +705,6 @@ test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js:
> test/built-ins/Array/prototype/sort/S15.4.4.11_A4_T3.js:
>   default: 'Test262Error: #3: var obj = {}; obj.sort = Array.prototype.sort; obj[0] = "z"; obj[1] = "y"; obj[2] = "x"; obj.length = -4294967294; obj.sort(); obj[0] === "z". Actual: y'
>   strict mode: 'Test262Error: #3: var obj = {}; obj.sort = Array.prototype.sort; obj[0] = "z"; obj[1] = "y"; obj[2] = "x"; obj.length = -4294967294; obj.sort(); obj[0] === "z". Actual: y'
>-test/built-ins/Array/prototype/sort/comparefn-nonfunction-call-throws.js:
>-  default: 'Test262Error: sample.sort(null); Expected a TypeError to be thrown but no exception was thrown at all'
>-  strict mode: 'Test262Error: sample.sort(null); Expected a TypeError to be thrown but no exception was thrown at all'
> test/built-ins/Array/prototype/splice/S15.4.4.12_A3_T1.js:
>   default: 'Test262Error: #1: var obj = {}; obj.splice = Array.prototype.splice; obj[0] = "x"; obj[4294967295] = "y"; obj.length = 4294967296; var arr = obj.splice(4294967295,1); arr.length === 1. Actual: 0'
>   strict mode: 'Test262Error: #1: var obj = {}; obj.splice = Array.prototype.splice; obj[0] = "x"; obj[4294967295] = "y"; obj.length = 4294967296; var arr = obj.splice(4294967295,1); arr.length === 1. Actual: 0'

Actions: View | Formatted Diff | Diff

Attachments on bug 186458: 342364