[webkit-changes] [WebKit/WebKit] c8c811: [JSC] Improve resizable TypedArray's slice impleme...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: c8c81173ec65dce5414985944e7f12e04a711308
      https://github.com/WebKit/WebKit/commit/c8c81173ec65dce5414985944e7f12e04a711308
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-11-25 (Fri, 25 Nov 2022)

  Changed paths:
    A JSTests/stress/v8-regress-1376784.js
    A JSTests/stress/v8-regress-1380398.js
    A JSTests/stress/v8-regress-crbug-1359991.js
    A JSTests/stress/v8-regress-crbug-1362487.js
    A JSTests/stress/v8-regress-crbug-1384474-variant2.js
    A JSTests/stress/v8-regress-crbug-1384474-variant3.js
    A JSTests/stress/v8-regress-crbug-1384474.js
    A JSTests/stress/v8-regress-crbug-1392577.js
    M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

  Log Message:
  -----------
  [JSC] Improve resizable TypedArray's slice implementation's spec conformance
https://bugs.webkit.org/show_bug.cgi?id=248337
rdar://problem/102661384

Reviewed by Ross Kirsling.

This patch fixes TypedArray#slice's spec conformance a bit: test length against previously passed value (not updatedLength).
We also import new V8 tests more.

* JSTests/stress/v8-regress-1376784.js: Added.
(test.const.factory.async foo):
(test.const.factory):
(test):
* JSTests/stress/v8-regress-1380398.js: Added.
(test):
* JSTests/stress/v8-regress-crbug-1359991.js: Added.
(MyFloat64Array):
* JSTests/stress/v8-regress-crbug-1362487.js: Added.
(MyInt8Array):
(assertThrows):
* JSTests/stress/v8-regress-crbug-1384474-variant2.js: Added.
(ta.Symbol.species):
(assertThrows):
* JSTests/stress/v8-regress-crbug-1384474-variant3.js: Added.
(ta.Symbol.species):
(assertThrows):
* JSTests/stress/v8-regress-crbug-1384474.js: Added.
(ta.Symbol.species):
(assertThrows):
* JSTests/stress/v8-regress-crbug-1392577.js: Added.
(start.valueOf):
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::speciesConstruct):
(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewProtoFuncSubarray):

Canonical link: https://commits.webkit.org/257018@main