225062 2021-04-26 11:28:00 -0700 %TypedArray%.prototype.sort() should not use a regular array as a temp buffer. 2021-04-26 14:04:32 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam ews-watchlist joepeck keith_miller msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1754274 0 mark.lam 2021-04-26 11:28:00 -0700 rdar://77021547 1754287 1 427073 mark.lam 2021-04-26 11:56:04 -0700 Created attachment 427073 proposed patch. 1754291 2 427073 ysuzuki 2021-04-26 12:03:52 -0700 Comment on attachment 427073 proposed patch. r=me 1754293 3 427073 ysuzuki 2021-04-26 12:06:18 -0700 Comment on attachment 427073 proposed patch. Ah, wait. When will we hit 0 accessor? I don't think we should not hit that. 1754303 4 mark.lam 2021-04-26 12:20:33 -0700 (In reply to Yusuke Suzuki from comment #3) > Comment on attachment 427073 [details] > proposed patch. > > Ah, wait. When will we hit 0 accessor? I don't think we should not hit that. Builtin typedArrayMerge() does assignment into the dst array, and reads from the src array. Builtin typedArrayMergeSort() swaps dst and src array for each width iteration. So, the regular array temp will be accessed as dst and src on different iterations, and accessors can get involved. 1754365 5 mark.lam 2021-04-26 14:04:32 -0700 Thanks for the review. Landed in r276612: <http://trac.webkit.org/r276612>. 427073 2021-04-26 11:56:04 -0700 2021-04-26 12:03:52 -0700 proposed patch. bug-225062.patch text/plain 2969 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyNzY2MDQpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDIxLTA0LTI2ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICAlVHlwZWRBcnJheSUucHJvdG90eXBlLnNvcnQoKSBzaG91bGQgbm90IHVz ZSBhIHJlZ3VsYXIgYXJyYXkgYXMgYSB0ZW1wIGJ1ZmZlci4KKyAgICAgICAgaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTA2MgorICAgICAgICByZGFyOi8vNzcwMjE1 NDcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIHN0 cmVzcy90eXBlZGFycmF5LXNvcnQtc2hvdWxkLW5vdC11c2UtYS1yZWd1bGFyLWFycmF5LWFzLXRl bXAtYnVmZmVyLmpzOiBBZGRlZC4KKwogMjAyMS0wNC0yNiAgQWxleGV5IFNodmF5a2EgIDxzaHZh aWthbGVzaEBnbWFpbC5jb20+CiAKICAgICAgICAgW0pTQ10gT3JkaW5hcnlTZXQgc2hvdWxkIGlu dm9rZSBjdXN0b20gW1tTZXRdXSBtZXRob2RzCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy90eXBlZGFy cmF5LXNvcnQtc2hvdWxkLW5vdC11c2UtYS1yZWd1bGFyLWFycmF5LWFzLXRlbXAtYnVmZmVyLmpz Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIEpTVGVzdHMvc3RyZXNzL3R5cGVkYXJyYXktc29ydC1zaG91bGQtbm90 LXVzZS1hLXJlZ3VsYXItYXJyYXktYXMtdGVtcC1idWZmZXIuanMJKG5vbmV4aXN0ZW50KQorKysg SlNUZXN0cy9zdHJlc3MvdHlwZWRhcnJheS1zb3J0LXNob3VsZC1ub3QtdXNlLWEtcmVndWxhci1h cnJheS1hcy10ZW1wLWJ1ZmZlci5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDE4IEBACitm dW5jdGlvbiBmb28oKSB7CisgICAgbGV0IGFycjEgPSBuZXcgSW50MzJBcnJheShuZXcgU2hhcmVk QXJyYXlCdWZmZXIoMTIpKTsKKyAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoQXJyYXkucHJvdG90 eXBlLCAiMCIsIHsKKyAgICAgICAgZ2V0OiAoKSA9PiB7CisgICAgICAgICAgICBmdW5jdGlvbiog Zm9vMigpIHsKKyAgICAgICAgICAgICAgICB0aHJvdyAic3R1ZmYiOworICAgICAgICAgICAgfTsK KyAgICAgICAgICAgIGZvbzIoKTsKKyAgICAgICAgfSwKKyAgICAgICAgc2V0OiAoKSA9PiB7IH0K KyAgICB9KTsKKyAgICBhcnIxLnNvcnQoKTsKK30KKwordHJ5IHsKKyAgICBmb28oKQorfSBjYXRj aCAoeSkgeworfQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNzY1OTYp CisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0x LDMgKzEsMjIgQEAKKzIwMjEtMDQtMjYgIE1hcmsgTGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgor CisgICAgICAgICVUeXBlZEFycmF5JS5wcm90b3R5cGUuc29ydCgpIHNob3VsZCBub3QgdXNlIGEg cmVndWxhciBhcnJheSBhcyBhIHRlbXAgYnVmZmVyLgorICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI1MDYyCisgICAgICAgIHJkYXI6Ly83NzAyMTU0Nwor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICVUeXBlZEFy cmF5JS5wcm90b3R5cGUuc29ydCgpIHNob3VsZCBub3QgYmUgYWZmZWN0ZWQgYnkgcHJvcGVydHkg Y2hhbmdlcyBpbgorICAgICAgICBBcnJheS5wcm90b3R5cGUuCisKKyAgICAgICAgUmVmZXJlbmNl czoKKyAgICAgICAgWzFdIGh0dHBzOi8vdGMzOS5lcy9lY21hMjYyLyNzZWMtJXR5cGVkYXJyYXkl LnByb3RvdHlwZS5zb3J0CisgICAgICAgIFsyXSBodHRwczovL3RjMzkuZXMvZWNtYTI2Mi8jc2Vj LWFycmF5LnByb3RvdHlwZS5zb3J0CisgICAgICAgIFszXSBodHRwczovL3RjMzkuZXMvZWNtYTI2 Mi8jc2VjLXNvcnRjb21wYXJlCisKKyAgICAgICAgKiBidWlsdGlucy9UeXBlZEFycmF5UHJvdG90 eXBlLmpzOgorICAgICAgICAoZ2xvYmFsUHJpdmF0ZS50eXBlZEFycmF5TWVyZ2VTb3J0KToKKwog MjAyMS0wNC0yNiAgQWxleGV5IFNodmF5a2EgIDxzaHZhaWthbGVzaEBnbWFpbC5jb20+CiAKICAg ICAgICAgW0pTQ10gT3JkaW5hcnlTZXQgc2hvdWxkIGludm9rZSBjdXN0b20gW1tTZXRdXSBtZXRo b2RzCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvVHlwZWRBcnJheVByb3Rv dHlwZS5qcwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvVHlw ZWRBcnJheVByb3RvdHlwZS5qcwkocmV2aXNpb24gMjc2NTk2KQorKysgU291cmNlL0phdmFTY3Jp cHRDb3JlL2J1aWx0aW5zL1R5cGVkQXJyYXlQcm90b3R5cGUuanMJKHdvcmtpbmcgY29weSkKQEAg LTE3Myw3ICsxNzMsOCBAQCBmdW5jdGlvbiB0eXBlZEFycmF5TWVyZ2VTb3J0KGFycmF5LCB2YWx1 CiB7CiAgICAgInVzZSBzdHJpY3QiOwogCi0gICAgdmFyIGJ1ZmZlciA9IEBuZXdBcnJheVdpdGhT aXplKHZhbHVlQ291bnQpOworICAgIHZhciBjb25zdHJ1Y3RvciA9IEB0eXBlZEFycmF5R2V0T3Jp Z2luYWxDb25zdHJ1Y3RvcihhcnJheSk7CisgICAgdmFyIGJ1ZmZlciA9IG5ldyBjb25zdHJ1Y3Rv cih2YWx1ZUNvdW50KTsKICAgICB2YXIgZHN0ID0gYnVmZmVyOwogICAgIHZhciBzcmMgPSBhcnJh eTsKIAo=