[webkit-changes] [WebKit/WebKit] d3b432: REGRESSION (270691 at main): test262 test/built-ins/T...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: d3b43220734e87c869665cd41a495586acf9e274
      https://github.com/WebKit/WebKit/commit/d3b43220734e87c869665cd41a495586acf9e274
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2023-12-13 (Wed, 13 Dec 2023)

  Changed paths:
    M Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
    M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

  Log Message:
  -----------
  REGRESSION (270691 at main): test262 test/built-ins/TypedArray/prototype/sort/sort-tonumber.js: Underlying ArrayBuffer has been detached from the view or out-of-bounds
https://bugs.webkit.org/show_bug.cgi?id=266245
rdar://119506259

Reviewed by Yusuke Suzuki.

There is no need to to check detached buffer and throw TypeError
after comparator function being executed for %TypedArray%.prototype.sort.
See steps 6-10 in [1].

[1] https://tc39.es/ecma262/#sec-%typedarray%.prototype.sort

* Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h:
(JSC::validateTypedArray):
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncSortImpl):
(JSC::genericTypedArrayViewProtoFuncSort):

Canonical link: https://commits.webkit.org/271988@main