[Webkit-unassigned] [Bug 280381] New: [JSC] Check if the species watchpoint is valid before `array.concat()` fast path

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Sep 25 18:46:46 PDT 2024


https://bugs.webkit.org/show_bug.cgi?id=280381

            Bug ID: 280381
           Summary: [JSC] Check if the species watchpoint is valid before
                    `array.concat()` fast path
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: aosukeke at gmail.com

The Array.prototype.concat test262 started failing due to https://commits.webkit.org/284060@main.
    This was because the species check was not performed before entering the fast path.

------

! NEW FAIL test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js (strict mode)
Exception: Test262Error: Object.getPrototypeOf(array.concat()) returns CustomCtor.prototype Expected SameValue(«», «[object Object]») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-non-object.js (strict mode)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js (default)
Exception: Test262Error: Object.getPrototypeOf(array.concat()) returns CustomCtor.prototype Expected SameValue(«», «[object Object]») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-non-object.js (default)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-non-ctor.js (strict mode)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-non-ctor.js (default)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-poisoned.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-poisoned.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species.js (strict mode)
Exception: Test262Error: The value of callCount is expected to be 1 Expected SameValue(«0», «1») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-species.js (default)
Exception: Test262Error: The value of callCount is expected to be 1 Expected SameValue(«0», «1») to be true

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-abrupt.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-poisoned.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-species-abrupt.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-poisoned.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240926/59906ee7/attachment.htm>


More information about the webkit-unassigned mailing list