[webkit-changes] [WebKit/WebKit] 0e5745: JSC should throw an exception when BigUint64Array ...

[Commit Queue]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0e5745978de8cc7314410e74cb44b20a09740872
      https://github.com/WebKit/WebKit/commit/0e5745978de8cc7314410e74cb44b20a09740872
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2023-11-02 (Thu, 02 Nov 2023)

  Changed paths:
    A JSTests/stress/bigint-array-set.js
    M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

  Log Message:
  -----------
  JSC should throw an exception when BigUint64Array copy value from Int32Array
https://bugs.webkit.org/show_bug.cgi?id=263954
rdar://117816146

Reviewed by Yusuke Suzuki.

BigInt array set for non-BigInt typed array should throw exceptions.
So, we shouldn't copy non-BigInt values from other typed array to
BigInt for TypedArray.prototype.set.

* JSTests/stress/bigint-array-set.js: Added.
(i.catch):
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::copyFromInt32ShapeArray):
(JSC::JSGenericTypedArrayView<Adaptor>::copyFromDoubleShapeArray):
(JSC::JSGenericTypedArrayView<Adaptor>::setFromArrayLike):

Canonical link: https://commits.webkit.org/270133@main