[Webkit-unassigned] [Bug 280381] New: [JSC] Check if the species watchpoint is valid before `array.concat()` fast path
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Sep 25 18:46:46 PDT 2024
https://bugs.webkit.org/show_bug.cgi?id=280381
Bug ID: 280381
Summary: [JSC] Check if the species watchpoint is valid before
`array.concat()` fast path
Product: WebKit
Version: WebKit Nightly Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: aosukeke at gmail.com
The Array.prototype.concat test262 started failing due to https://commits.webkit.org/284060@main.
This was because the species check was not performed before entering the fast path.
------
! NEW FAIL test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js (strict mode)
Exception: Test262Error: Object.getPrototypeOf(array.concat()) returns CustomCtor.prototype Expected SameValue(«», «[object Object]») to be true
! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-non-object.js (strict mode)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js (default)
Exception: Test262Error: Object.getPrototypeOf(array.concat()) returns CustomCtor.prototype Expected SameValue(«», «[object Object]») to be true
! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-non-object.js (default)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-species-non-ctor.js (strict mode)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-species-non-ctor.js (default)
Exception: Test262Error: a.concat() throws a TypeError exception Expected a TypeError to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-species-poisoned.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-species-poisoned.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-species.js (strict mode)
Exception: Test262Error: The value of callCount is expected to be 1 Expected SameValue(«0», «1») to be true
! NEW FAIL test/built-ins/Array/prototype/concat/create-species.js (default)
Exception: Test262Error: The value of callCount is expected to be 1 Expected SameValue(«0», «1») to be true
! NEW FAIL test/built-ins/Array/prototype/concat/create-species-abrupt.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-poisoned.js (strict mode)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-species-abrupt.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all
! NEW FAIL test/built-ins/Array/prototype/concat/create-ctor-poisoned.js (default)
Exception: Test262Error: a.concat() throws a Test262Error exception Expected a Test262Error to be thrown but no exception was thrown at all
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240926/59906ee7/attachment.htm>
More information about the webkit-unassigned
mailing list