⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 202926 in webkit


Ignore:
Timestamp:
Jul 7, 2016, 12:03:27 PM (10 years ago)
Author:
benjamin@webkit.org
Message:

[JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
​https://bugs.webkit.org/show_bug.cgi?id=159505

Reviewed by Mark Lam.

Source/JavaScriptCore:

The code was using (value)|0 which is effectively a ToInt32.
This fails on large integers and +-Infinity.

Spec: ​https://tc39.github.io/ecma262/#sec-array.prototype.includes

  • builtins/ArrayPrototype.js:

(includes):

LayoutTests:

  • js/array-includes-expected.txt:
  • js/script-tests/array-includes.js:
Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r202916 r202926  
     12016-07-07  Benjamin Poulain  <benjamin@webkit.org>
     2
     3        [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
     4        https://bugs.webkit.org/show_bug.cgi?id=159505
     5
     6        Reviewed by Mark Lam.
     7
     8        * js/array-includes-expected.txt:
     9        * js/script-tests/array-includes.js:
     10
    1112016-07-07  Benjamin Poulain  <benjamin@webkit.org>
    212

  • trunk/LayoutTests/js/array-includes-expected.txt

    r184582 r202926  
    3535PASS var obj = { 0: 1, 1: 1, 2: 1, length: -0 }; Array.prototype.includes.call(obj, 1) is false
    3636PASS var obj = { 0: 1, 1: 1, 2: 1, length: -3 }; Array.prototype.includes.call(obj, 1) is false
     37The index is converted to integer
     38PASS [2, 3, 5, 7, 11, 13, 17].includes(2, NaN) is true
     39PASS [2, 3, 5, 7, 11, 13, 17].includes(7, NaN) is true
     40PASS [2, 3, 5, 7, 11, 13, 17].includes(17, NaN) is true
     41PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Infinity) is false
     42PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Infinity) is false
     43PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Infinity) is false
     44PASS [2, 3, 5, 7, 11, 13, 17].includes(2, -Infinity) is true
     45PASS [2, 3, 5, 7, 11, 13, 17].includes(7, -Infinity) is true
     46PASS [2, 3, 5, 7, 11, 13, 17].includes(17, -Infinity) is true
     47PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER) is false
     48PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER) is false
     49PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER) is false
     50PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER + 1) is false
     51PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER + 1) is false
     52PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER + 1) is false
     53PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER) is true
     54PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER) is true
     55PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER) is true
     56PASS [2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER - 1) is true
     57PASS [2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER - 1) is true
     58PASS [2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER - 1) is true
     59PASS [2, 3, 5, 7, 11, 13, 17].includes(2, { valueOf: () => { return 1; } }) is false
     60PASS [2, 3, 5, 7, 11, 13, 17].includes(7, { valueOf: () => { return 1; } }) is true
     61PASS [2, 3, 5, 7, 11, 13, 17].includes(17, { valueOf: () => { return 1; } }) is true
     62PASS [2, 3, 5, 7, 11, 13, 17].includes(2, { toString: () => { return '1'; } }) is false
     63PASS [2, 3, 5, 7, 11, 13, 17].includes(7, { toString: () => { return '1'; } }) is true
     64PASS [2, 3, 5, 7, 11, 13, 17].includes(17, { toString: () => { return '1'; } }) is true
     65PASS [2, 3, 5, 7, 11, 13, 17].includes(2, '1') is false
     66PASS [2, 3, 5, 7, 11, 13, 17].includes(7, '1') is true
     67PASS [2, 3, 5, 7, 11, 13, 17].includes(17, '1') is true
    3768PASS successfullyParsed is true
    3869

  • trunk/LayoutTests/js/script-tests/array-includes.js

    r184582 r202926  
    4848shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: -0 }; Array.prototype.includes.call(obj, 1)");
    4949shouldBeFalse("var obj = { 0: 1, 1: 1, 2: 1, length: -3 }; Array.prototype.includes.call(obj, 1)");
     50
     51debug("The index is converted to integer");
     52shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, NaN)");
     53shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, NaN)");
     54shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, NaN)");
     55shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Infinity)");
     56shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Infinity)");
     57shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Infinity)");
     58shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, -Infinity)");
     59shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, -Infinity)");
     60shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, -Infinity)");
     61shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER)");
     62shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER)");
     63shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER)");
     64shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MAX_SAFE_INTEGER + 1)");
     65shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MAX_SAFE_INTEGER + 1)");
     66shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MAX_SAFE_INTEGER + 1)");
     67shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER)");
     68shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER)");
     69shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER)");
     70shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(2, Number.MIN_SAFE_INTEGER - 1)");
     71shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, Number.MIN_SAFE_INTEGER - 1)");
     72shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, Number.MIN_SAFE_INTEGER - 1)");
     73
     74shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, { valueOf: () => { return 1; } })");
     75shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, { valueOf: () => { return 1; } })");
     76shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, { valueOf: () => { return 1; } })");
     77
     78shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, { toString: () => { return '1'; } })");
     79shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, { toString: () => { return '1'; } })");
     80shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, { toString: () => { return '1'; } })");
     81
     82shouldBeFalse("[2, 3, 5, 7, 11, 13, 17].includes(2, '1')");
     83shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(7, '1')");
     84shouldBeTrue("[2, 3, 5, 7, 11, 13, 17].includes(17, '1')");

  • trunk/Source/JavaScriptCore/ChangeLog

    r202916 r202926  
     12016-07-07  Benjamin Poulain  <benjamin@webkit.org>
     2
     3        [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
     4        https://bugs.webkit.org/show_bug.cgi?id=159505
     5
     6        Reviewed by Mark Lam.
     7
     8        The code was using (value)|0 which is effectively a ToInt32.
     9        This fails on large integers and +-Infinity.
     10
     11        Spec: https://tc39.github.io/ecma262/#sec-array.prototype.includes
     12
     13        * builtins/ArrayPrototype.js:
     14        (includes):
     15
    1162016-07-07  Benjamin Poulain  <benjamin@webkit.org>
    217

  • trunk/Source/JavaScriptCore/builtins/ArrayPrototype.js

    r202280 r202926  
    435435    var fromIndex = 0;
    436436    if (arguments.length > 1 && arguments[1] !== @undefined)
    437         fromIndex = arguments[1] | 0;
     437        fromIndex = @toInteger(arguments[1]);
    438438
    439439    var index;
Note: See TracChangeset for help on using the changeset viewer.