<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[203297] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/203297">203297</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-07-15 13:58:52 -0700 (Fri, 15 Jul 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>%TypedArray%.prototype.indexOf is coercing non-integers or non-floats to numbers wrongly
https://bugs.webkit.org/show_bug.cgi?id=159400
Reviewed by Geoffrey Garen.
This patch fixes coercion of non-numbers in indexOf/lastIndexOf.
Additionally, this patch fixes an issue with includes where it
would not check that the buffer remained non-neutered after
calling the toInteger() function. Lastly, some extra release
asserts have been added in some places to inform us of any issues
in the future.
Additionally, this patch changes bool toNativeFromDouble to
Optional<Type> toNativeFromDoubleWithoutCoercion. This makes it a
little clearer what the function does and also removes the return
argument. The only behavior change is that the function no longer
coerces non-numbers into numbers. That behavior was unused (maybe
unintended), however.
* runtime/JSGenericTypedArrayView.h:
(JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion):
(JSC::JSGenericTypedArrayView::sort):
(JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue): Deleted.
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncCopyWithin):
(JSC::genericTypedArrayViewProtoFuncIncludes):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
* runtime/ToNativeFromValue.h:
(JSC::toNativeFromValueWithoutCoercion):
(JSC::toNativeFromValue): Deleted.
* runtime/TypedArrayAdaptors.h:
(JSC::IntegralTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
(JSC::IntegralTypedArrayAdaptor::toNativeFromUint32WithoutCoercion):
(JSC::IntegralTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
(JSC::FloatTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
(JSC::FloatTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
(JSC::Uint8ClampedAdaptor::toNativeFromInt32WithoutCoercion):
(JSC::Uint8ClampedAdaptor::toNativeFromDoubleWithoutCoercion):
(JSC::IntegralTypedArrayAdaptor::toNativeFromInt32): Deleted.
(JSC::IntegralTypedArrayAdaptor::toNativeFromUint32): Deleted.
(JSC::IntegralTypedArrayAdaptor::toNativeFromDouble): Deleted.
(JSC::FloatTypedArrayAdaptor::toNativeFromInt32): Deleted.
(JSC::FloatTypedArrayAdaptor::toNativeFromDouble): Deleted.
(JSC::Uint8ClampedAdaptor::toNativeFromInt32): Deleted.
(JSC::Uint8ClampedAdaptor::toNativeFromDouble): Deleted.
* tests/stress/resources/typedarray-test-helper-functions.js:
* tests/stress/typedarray-functions-with-neutered.js:
(callWithArgs):
* tests/stress/typedarray-includes.js: Added.
* tests/stress/typedarray-indexOf.js:
* tests/stress/typedarray-lastIndexOf.js:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeToNativeFromValueh">trunk/Source/JavaScriptCore/runtime/ToNativeFromValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypedArrayAdaptorsh">trunk/Source/JavaScriptCore/runtime/TypedArrayAdaptors.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressresourcestypedarraytesthelperfunctionsjs">trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-test-helper-functions.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarrayfunctionswithneuteredjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-functions-with-neutered.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarrayindexOfjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-indexOf.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarraylastIndexOfjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-lastIndexOf.js</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoretestsstresstypedarrayincludesjs">trunk/Source/JavaScriptCore/tests/stress/typedarray-includes.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -1,3 +1,58 @@
</span><ins>+2016-07-15 Keith Miller <keith_miller@apple.com>
+
+ %TypedArray%.prototype.indexOf is coercing non-integers or non-floats to numbers wrongly
+ https://bugs.webkit.org/show_bug.cgi?id=159400
+
+ Reviewed by Geoffrey Garen.
+
+ This patch fixes coercion of non-numbers in indexOf/lastIndexOf.
+ Additionally, this patch fixes an issue with includes where it
+ would not check that the buffer remained non-neutered after
+ calling the toInteger() function. Lastly, some extra release
+ asserts have been added in some places to inform us of any issues
+ in the future.
+
+ Additionally, this patch changes bool toNativeFromDouble to
+ Optional<Type> toNativeFromDoubleWithoutCoercion. This makes it a
+ little clearer what the function does and also removes the return
+ argument. The only behavior change is that the function no longer
+ coerces non-numbers into numbers. That behavior was unused (maybe
+ unintended), however.
+
+ * runtime/JSGenericTypedArrayView.h:
+ (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion):
+ (JSC::JSGenericTypedArrayView::sort):
+ (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue): Deleted.
+ * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+ (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+ (JSC::genericTypedArrayViewProtoFuncIncludes):
+ (JSC::genericTypedArrayViewProtoFuncIndexOf):
+ (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+ * runtime/ToNativeFromValue.h:
+ (JSC::toNativeFromValueWithoutCoercion):
+ (JSC::toNativeFromValue): Deleted.
+ * runtime/TypedArrayAdaptors.h:
+ (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
+ (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32WithoutCoercion):
+ (JSC::IntegralTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
+ (JSC::FloatTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
+ (JSC::FloatTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
+ (JSC::Uint8ClampedAdaptor::toNativeFromInt32WithoutCoercion):
+ (JSC::Uint8ClampedAdaptor::toNativeFromDoubleWithoutCoercion):
+ (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32): Deleted.
+ (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32): Deleted.
+ (JSC::IntegralTypedArrayAdaptor::toNativeFromDouble): Deleted.
+ (JSC::FloatTypedArrayAdaptor::toNativeFromInt32): Deleted.
+ (JSC::FloatTypedArrayAdaptor::toNativeFromDouble): Deleted.
+ (JSC::Uint8ClampedAdaptor::toNativeFromInt32): Deleted.
+ (JSC::Uint8ClampedAdaptor::toNativeFromDouble): Deleted.
+ * tests/stress/resources/typedarray-test-helper-functions.js:
+ * tests/stress/typedarray-functions-with-neutered.js:
+ (callWithArgs):
+ * tests/stress/typedarray-includes.js: Added.
+ * tests/stress/typedarray-indexOf.js:
+ * tests/stress/typedarray-lastIndexOf.js:
+
</ins><span class="cx"> 2016-07-15 Csaba Osztrogonác <ossy@webkit.org>
</span><span class="cx">
</span><span class="cx"> Add new functions to ARMAssembler after r202214
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -186,10 +186,11 @@
</span><span class="cx">
</span><span class="cx"> static ElementType toAdaptorNativeFromValue(ExecState* exec, JSValue jsValue) { return toNativeFromValue<Adaptor>(exec, jsValue); }
</span><span class="cx">
</span><del>- static bool toAdaptorNativeFromValue(ExecState* exec, JSValue jsValue, ElementType& result) { return toNativeFromValue<Adaptor>(exec, jsValue, result); }
</del><ins>+ static Optional<ElementType> toAdaptorNativeFromValueWithoutCoercion(JSValue jsValue) { return toNativeFromValueWithoutCoercion<Adaptor>(jsValue); }
</ins><span class="cx">
</span><span class="cx"> void sort()
</span><span class="cx"> {
</span><ins>+ RELEASE_ASSERT(!isNeutered());
</ins><span class="cx"> switch (Adaptor::typeValue) {
</span><span class="cx"> case TypeFloat32:
</span><span class="cx"> sortFloat<int32_t>();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -154,14 +154,14 @@
</span><span class="cx"> if (vm.exception())
</span><span class="cx"> return encodedJSValue();
</span><span class="cx">
</span><del>- if (thisObject->isNeutered())
- return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
-
</del><span class="cx"> if (final < from)
</span><span class="cx"> return JSValue::encode(exec->thisValue());
</span><span class="cx">
</span><span class="cx"> long count = std::min(length - std::max(to, from), final - from);
</span><span class="cx">
</span><ins>+ if (thisObject->isNeutered())
+ return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+
</ins><span class="cx"> typename ViewClass::ElementType* array = thisObject->typedVector();
</span><span class="cx"> memmove(array + to, array + from, count * thisObject->elementSize);
</span><span class="cx">
</span><span class="lines">@@ -171,6 +171,7 @@
</span><span class="cx"> template<typename ViewClass>
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIncludes(ExecState* exec)
</span><span class="cx"> {
</span><ins>+ VM& vm = exec->vm();
</ins><span class="cx"> ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
</span><span class="cx"> if (thisObject->isNeutered())
</span><span class="cx"> return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</span><span class="lines">@@ -183,19 +184,21 @@
</span><span class="cx"> JSValue valueToFind = exec->argument(0);
</span><span class="cx">
</span><span class="cx"> unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
</span><ins>+ if (vm.exception())
+ return JSValue::encode(jsUndefined());
</ins><span class="cx">
</span><del>- if (!valueToFind.isNumber())
- return JSValue::encode(jsBoolean(false));
</del><ins>+ if (thisObject->isNeutered())
+ return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx">
</span><span class="cx"> typename ViewClass::ElementType* array = thisObject->typedVector();
</span><del>- typename ViewClass::ElementType target;
- if (!ViewClass::toAdaptorNativeFromValue(exec, valueToFind, target))
</del><ins>+ auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
+ if (!targetOption)
</ins><span class="cx"> return JSValue::encode(jsBoolean(false));
</span><span class="cx">
</span><del>- if (exec->hadException())
- return JSValue::encode(jsUndefined());
</del><ins>+ ASSERT(!vm.exception());
+ RELEASE_ASSERT(!thisObject->isNeutered());
</ins><span class="cx">
</span><del>- if (std::isnan(static_cast<double>(target))) {
</del><ins>+ if (std::isnan(static_cast<double>(*targetOption))) {
</ins><span class="cx"> for (; index < length; ++index) {
</span><span class="cx"> if (std::isnan(static_cast<double>(array[index])))
</span><span class="cx"> return JSValue::encode(jsBoolean(true));
</span><span class="lines">@@ -202,7 +205,7 @@
</span><span class="cx"> }
</span><span class="cx"> } else {
</span><span class="cx"> for (; index < length; ++index) {
</span><del>- if (array[index] == target)
</del><ins>+ if (array[index] == targetOption)
</ins><span class="cx"> return JSValue::encode(jsBoolean(true));
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -233,12 +236,14 @@
</span><span class="cx"> return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</span><span class="cx">
</span><span class="cx"> typename ViewClass::ElementType* array = thisObject->typedVector();
</span><del>- typename ViewClass::ElementType target = ViewClass::toAdaptorNativeFromValue(exec, valueToFind);
- if (exec->hadException())
- return JSValue::encode(jsUndefined());
</del><ins>+ auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
+ if (!targetOption)
+ return JSValue::encode(jsNumber(-1));
+ ASSERT(!vm.exception());
+ RELEASE_ASSERT(!thisObject->isNeutered());
</ins><span class="cx">
</span><span class="cx"> for (; index < length; ++index) {
</span><del>- if (array[index] == target)
</del><ins>+ if (array[index] == targetOption)
</ins><span class="cx"> return JSValue::encode(jsNumber(index));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -287,6 +292,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncLastIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx"> // 22.2.3.16
</span><ins>+ VM& vm = exec->vm();
</ins><span class="cx"> ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
</span><span class="cx"> if (thisObject->isNeutered())
</span><span class="cx"> return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</span><span class="lines">@@ -311,16 +317,22 @@
</span><span class="cx"> index = static_cast<unsigned>(fromDouble);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ if (vm.exception())
+ return JSValue::encode(JSValue());
+
</ins><span class="cx"> if (thisObject->isNeutered())
</span><span class="cx"> return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</span><span class="cx">
</span><ins>+ auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
+ if (!targetOption)
+ return JSValue::encode(jsNumber(-1));
+
</ins><span class="cx"> typename ViewClass::ElementType* array = thisObject->typedVector();
</span><del>- typename ViewClass::ElementType target = ViewClass::toAdaptorNativeFromValue(exec, valueToFind);
- if (exec->hadException())
- return JSValue::encode(jsUndefined());
</del><ins>+ ASSERT(!vm.exception());
+ RELEASE_ASSERT(!thisObject->isNeutered());
</ins><span class="cx">
</span><span class="cx"> for (; index >= 0; --index) {
</span><del>- if (array[index] == target)
</del><ins>+ if (array[index] == targetOption)
</ins><span class="cx"> return JSValue::encode(jsNumber(index));
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeToNativeFromValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ToNativeFromValue.h (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ToNativeFromValue.h 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/runtime/ToNativeFromValue.h 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -49,13 +49,13 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Adaptor>
</span><del>-bool toNativeFromValue(ExecState* exec, JSValue value, typename Adaptor::Type& result)
</del><ins>+Optional<typename Adaptor::Type> toNativeFromValueWithoutCoercion(JSValue value)
</ins><span class="cx"> {
</span><ins>+ if (!value.isNumber())
+ return Nullopt;
</ins><span class="cx"> if (value.isInt32())
</span><del>- return Adaptor::toNativeFromInt32(value.asInt32(), result);
- if (value.isNumber())
- return Adaptor::toNativeFromDouble(value.asDouble(), result);
- return Adaptor::toNativeFromDouble(value.toNumber(exec), result);
</del><ins>+ return Adaptor::toNativeFromInt32WithoutCoercion(value.asInt32());
+ return Adaptor::toNativeFromDoubleWithoutCoercion(value.asDouble());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypedArrayAdaptorsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TypedArrayAdaptors.h (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypedArrayAdaptors.h 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/runtime/TypedArrayAdaptors.h 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -79,36 +79,31 @@
</span><span class="cx"> return OtherAdaptor::toNativeFromInt32(value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static bool toNativeFromInt32(int32_t value, Type& result)
</del><ins>+ static Optional<Type> toNativeFromInt32WithoutCoercion(int32_t value)
</ins><span class="cx"> {
</span><span class="cx"> if ((value >= 0 && static_cast<uint32_t>(value) > static_cast<uint32_t>(maxValue)) || value < static_cast<int32_t>(minValue))
</span><del>- return false;
-
- result = static_cast<Type>(value);
-
- return true;
</del><ins>+ return Nullopt;
+ return static_cast<Type>(value);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- static bool toNativeFromUint32(uint32_t value, Type& result)
</del><ins>+ static Optional<Type> toNativeFromUint32WithoutCoercion(uint32_t value)
</ins><span class="cx"> {
</span><span class="cx"> if (value > static_cast<uint32_t>(maxValue))
</span><del>- return false;
</del><ins>+ return Nullopt;
</ins><span class="cx">
</span><del>- result = static_cast<Type>(value);
-
- return true;
</del><ins>+ return static_cast<Type>(value);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- static bool toNativeFromDouble(double value, Type& result)
</del><ins>+ static Optional<Type> toNativeFromDoubleWithoutCoercion(double value)
</ins><span class="cx"> {
</span><span class="cx"> Type integer = static_cast<Type>(value);
</span><span class="cx"> if (static_cast<double>(integer) != value)
</span><del>- return false;
</del><ins>+ return Nullopt;
</ins><span class="cx">
</span><span class="cx"> if (value < 0)
</span><del>- return toNativeFromInt32(static_cast<int32_t>(value), result);
</del><ins>+ return toNativeFromInt32WithoutCoercion(static_cast<int32_t>(value));
</ins><span class="cx">
</span><del>- return toNativeFromUint32(static_cast<uint32_t>(value), result);
</del><ins>+ return toNativeFromUint32WithoutCoercion(static_cast<uint32_t>(value));
</ins><span class="cx"> }
</span><span class="cx"> };
</span><span class="cx">
</span><span class="lines">@@ -154,29 +149,25 @@
</span><span class="cx"> return OtherAdaptor::toNativeFromDouble(value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static bool toNativeFromInt32(int32_t value, Type& result)
</del><ins>+ static Optional<Type> toNativeFromInt32WithoutCoercion(int32_t value)
</ins><span class="cx"> {
</span><del>- result = static_cast<Type>(value);
- return true;
</del><ins>+ return static_cast<Type>(value);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- static Type toNativeFromDouble(double value, Type& result)
</del><ins>+ static Optional<Type> toNativeFromDoubleWithoutCoercion(double value)
</ins><span class="cx"> {
</span><del>- if (std::isnan(value) || std::isinf(value)) {
- result = static_cast<Type>(value);
- return true;
- }
</del><ins>+ if (std::isnan(value) || std::isinf(value))
+ return static_cast<Type>(value);
</ins><span class="cx">
</span><span class="cx"> Type valueResult = static_cast<Type>(value);
</span><span class="cx">
</span><span class="cx"> if (static_cast<double>(valueResult) != value)
</span><del>- return false;
</del><ins>+ return Nullopt;
</ins><span class="cx">
</span><span class="cx"> if (value < minValue || value > maxValue)
</span><del>- return false;
</del><ins>+ return Nullopt;
</ins><span class="cx">
</span><del>- result = valueResult;
- return true;
</del><ins>+ return valueResult;
</ins><span class="cx"> }
</span><span class="cx"> };
</span><span class="cx">
</span><span class="lines">@@ -264,24 +255,21 @@
</span><span class="cx"> return OtherAdaptor::toNativeFromInt32(value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static bool toNativeFromInt32(int32_t value, Type& result)
</del><ins>+ static Optional<Type> toNativeFromInt32WithoutCoercion(int32_t value)
</ins><span class="cx"> {
</span><span class="cx"> if (value > maxValue || value < minValue)
</span><del>- return false;
</del><ins>+ return Nullopt;
</ins><span class="cx">
</span><del>- result = static_cast<Type>(value);
-
- return true;
</del><ins>+ return static_cast<Type>(value);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- static bool toNativeFromDouble(double value, uint8_t& result)
</del><ins>+ static Optional<Type> toNativeFromDoubleWithoutCoercion(double value)
</ins><span class="cx"> {
</span><span class="cx"> uint8_t integer = static_cast<uint8_t>(value);
</span><span class="cx"> if (static_cast<double>(integer) != value)
</span><del>- return false;
</del><ins>+ return Nullopt;
</ins><span class="cx">
</span><del>- result = integer;
- return true;
</del><ins>+ return integer;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressresourcestypedarraytesthelperfunctionsjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-test-helper-functions.js (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-test-helper-functions.js 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/tests/stress/resources/typedarray-test-helper-functions.js 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -4,6 +4,8 @@
</span><span class="cx">
</span><span class="cx"> var signedArrays = [Int8Array, Int16Array, Int32Array, Float32Array, Float64Array];
</span><span class="cx">
</span><ins>+var intArrays = [Int8Array, Uint8Array, Uint8ClampedArray, Int16Array, Uint16Array, Int32Array, Uint32Array];
+
</ins><span class="cx"> var floatArrays = [Float32Array, Float64Array];
</span><span class="cx">
</span><span class="cx"> function forEachTypedArray(constructors, testFunction /* , initialValues */ ) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarrayfunctionswithneuteredjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/typedarray-functions-with-neutered.js (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-functions-with-neutered.js 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-functions-with-neutered.js 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -83,6 +83,7 @@
</span><span class="cx"> { func:proto.findIndex, args:["func"] },
</span><span class="cx"> { func:proto.forEach, args:["func"] },
</span><span class="cx"> { func:proto.indexOf, args:["na", "prim"] },
</span><ins>+ { func:proto.includes, args:["na", "prim"] },
</ins><span class="cx"> { func:proto.join, args:["prim"] },
</span><span class="cx"> { func:proto.lastIndexOf, args:["na", "prim"] },
</span><span class="cx"> { func:proto.map, args:["func"] },
</span><span class="lines">@@ -105,7 +106,7 @@
</span><span class="cx"> return argNum;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-function callWithArgs(func, array, args) {
</del><ins>+function callWithArgs(func, array, args, argNum) {
</ins><span class="cx"> let failed = true;
</span><span class="cx"> try {
</span><span class="cx"> func.call(array, ...args);
</span><span class="lines">@@ -115,7 +116,7 @@
</span><span class="cx"> failed = false;
</span><span class="cx"> }
</span><span class="cx"> if (failed)
</span><del>- throw new Error([func, args]);
</del><ins>+ throw new Error([func, argNum]);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx">
</span><span class="lines">@@ -135,13 +136,13 @@
</span><span class="cx"> transferArrayBuffer(array.buffer);
</span><span class="cx"> return func === array.every ? 1 : 0;
</span><span class="cx"> };
</span><del>- callWithArgs(func, array, callArgs);
</del><ins>+ callWithArgs(func, array, callArgs, argNum);
</ins><span class="cx"> } else if (arg === "prim") {
</span><span class="cx"> callArgs[argNum] = { [Symbol.toPrimitive]() {
</span><span class="cx"> transferArrayBuffer(array.buffer);
</span><span class="cx"> return argNum;
</span><span class="cx"> } };
</span><del>- callWithArgs(func, array, callArgs);
</del><ins>+ callWithArgs(func, array, callArgs, argNum);
</ins><span class="cx"> } else if (arg === "array") {
</span><span class="cx"> callArgs[argNum] = new Array(4);
</span><span class="cx"> callArgs[argNum].fill(2);
</span><span class="lines">@@ -150,7 +151,7 @@
</span><span class="cx"> return 1;
</span><span class="cx"> } };
</span><span class="cx"> Object.defineProperty(callArgs[argNum], 1, desc);
</span><del>- callWithArgs(func, array, callArgs);
</del><ins>+ callWithArgs(func, array, callArgs, argNum);
</ins><span class="cx"> } else
</span><span class="cx"> throw new Error(arg);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarrayincludesjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/typedarray-includes.js (0 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-includes.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-includes.js 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+load("resources/typedarray-test-helper-functions.js");
+
+for (constructor of typedArrays) {
+ let a = new constructor(10);
+ passed = true;
+ result = a.includes({ valueOf() { passed = false; return 1; } });
+ shouldBeTrue("passed");
+ shouldBeFalse("result");
+}
+finishJSTest();
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarrayindexOfjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/typedarray-indexOf.js (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-indexOf.js 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-indexOf.js 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -28,4 +28,40 @@
</span><span class="cx"> shouldBeTrue("testPrototypeFunction('indexOf', '(2, -1)', array, 3)");
</span><span class="cx"> shouldBeTrue("testPrototypeFunction('indexOf', '(2, -2)', array, 3)");
</span><span class="cx"> debug("");
</span><ins>+
+debug("Check object coersion");
+for (constructor of typedArrays) {
+ a = new constructor([0,2,3]);
+ passed = true;
+
+ shouldBe("a.indexOf({ valueOf() { passed = false; return 1; }})", "-1");
+ shouldBeTrue("passed");
+ shouldBe("a.indexOf(3, {valueOf: () => -1})", "2");
+
+ // test we don't coerce non-native values
+ shouldBe("a.indexOf(\"abc\")", "-1");
+ shouldBe("a.indexOf(null)", "-1");
+ shouldBe("a.indexOf(undefined)", "-1");
+ shouldBe("a.indexOf({1: ''})", "-1");
+ shouldBe("a.indexOf(\"\")", "-1");
+}
+
+
+for (constructor of intArrays) {
+ a = new constructor([0,2,3]);
+
+ shouldBe("a.indexOf(2.0)", "1");
+ shouldBe("a.indexOf(2.5)", "-1");
+}
+
+for (constructor of floatArrays) {
+ a = new constructor([0,2.0,3.6, NaN, Infinity]);
+
+ shouldBe("a.indexOf(2.0)", "1");
+ shouldBe("a.indexOf(2.5)", "-1");
+ shouldBe("a.indexOf(3.600001)", "-1");
+ shouldBe("a.indexOf(NaN)", "-1");
+ shouldBe("a.indexOf(Infinity)", "4");
+}
+
</ins><span class="cx"> finishJSTest();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstypedarraylastIndexOfjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/typedarray-lastIndexOf.js (203296 => 203297)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/typedarray-lastIndexOf.js 2016-07-15 20:56:29 UTC (rev 203296)
+++ trunk/Source/JavaScriptCore/tests/stress/typedarray-lastIndexOf.js 2016-07-15 20:58:52 UTC (rev 203297)
</span><span class="lines">@@ -25,4 +25,40 @@
</span><span class="cx"> shouldBeTrue("testPrototypeFunction('lastIndexOf', '(2, -1)', array, 3)");
</span><span class="cx"> shouldBeTrue("testPrototypeFunction('lastIndexOf', '(2, -2)', array, 0)");
</span><span class="cx"> debug("");
</span><ins>+
+debug("Check object coersion");
+for (constructor of typedArrays) {
+ a = new constructor([0,2,3]);
+ passed = true;
+
+ shouldBe("a.lastIndexOf({ valueOf() { passed = false; return 1; }})", "-1");
+ shouldBeTrue("passed");
+ shouldBe("a.lastIndexOf(3, {valueOf: () => 3})", "2");
+
+ // test we don't coerce non-native values
+ shouldBe("a.lastIndexOf(\"abc\")", "-1");
+ shouldBe("a.lastIndexOf(null)", "-1");
+ shouldBe("a.lastIndexOf(undefined)", "-1");
+ shouldBe("a.lastIndexOf({1: ''})", "-1");
+ shouldBe("a.lastIndexOf(\"\")", "-1");
+}
+
+
+for (constructor of intArrays) {
+ a = new constructor([0,2,3]);
+
+ shouldBe("a.lastIndexOf(2.0)", "1");
+ shouldBe("a.lastIndexOf(2.5)", "-1");
+}
+
+for (constructor of floatArrays) {
+ a = new constructor([0,2.0,3.6, NaN, Infinity]);
+
+ shouldBe("a.lastIndexOf(2.0)", "1");
+ shouldBe("a.lastIndexOf(2.5)", "-1");
+ shouldBe("a.lastIndexOf(3.600001)", "-1");
+ shouldBe("a.lastIndexOf(NaN)", "-1");
+ shouldBe("a.lastIndexOf(Infinity)", "4");
+}
+
</ins><span class="cx"> finishJSTest();
</span></span></pre>
</div>
</div>
</body>
</html>