Bug 193127 – Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Daniel Ehrenberg]

There seems to be an = missing on line 764 of builtins/ArrayPrototype.js

Test case: 
new (class extends Array { static get [Symbol.species]() { return document.all; } })(1, 2, 3).flat().constructor

This should throw a TypeError (as document.all is not a constructor), but instead it returns Array (as document.all == null). map and filter have the correct error-throwing semantics.

[Yusuke Suzuki]

We should have a fancy new bytecode instruction `is_undefined_or_null` and use it as @isUndefinedOrNull(value) in builtin JS to make our builtin JS code readable, and do not consider about masquerades-as-undefined anymore.

[Yusuke Suzuki]

Created attachment 358571 [details]
Patch

[EWS Watchlist]

Comment on attachment 358571 [details]
Patch

Attachment 358571 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/10667590

Number of test failures exceeded the failure limit.

[EWS Watchlist]

Created attachment 358581 [details]
Archive of layout-test-results from ews114 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews114  Port: mac-sierra  Platform: Mac OS X 10.12.6

[Yusuke Suzuki]

Created attachment 358590 [details]
Patch

[Saam Barati]

Comment on attachment 358590 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=358590&action=review

r=me

> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:1402
> +            if (!(child.m_type & SpecOther)) {
> +                setConstant(node, jsBoolean(false));
> +                constantWasSet = true;
> +                break;
> +            }

You should also have a rule for
!(child.m_type & ~SpecOther) => true

[Yusuke Suzuki]

Comment on attachment 358590 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=358590&action=review

>> Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:1402
>> +            }
> 
> You should also have a rule for
> !(child.m_type & ~SpecOther) => true

Sounds super nice! Fixed.

[Yusuke Suzuki]

Committed r239761: <https://trac.webkit.org/changeset/239761>

[Radar WebKit Bug Importer]

<rdar://problem/47135853>

[Alexey Shvayka]

*** Bug 171421 has been marked as a duplicate of this bug. ***