Changeset 211113 in webkit

Timestamp:

Jan 24, 2017, 3:24:35 PM (10 years ago)

Author:

fpizlo@apple.com

Message:

-0 is a valid array index and AtomicsObject should know this
​https://bugs.webkit.org/show_bug.cgi?id=167386

Reviewed by Mark Lam.

JSTests:

• stress/atomics-neg-zero.js: Added.

Source/JavaScriptCore:

• runtime/AtomicsObject.cpp: The bug title really says it all.

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/atomics-neg-zero.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/AtomicsObject.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2017-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+        -0 is a valid array index and AtomicsObject should know this
+        https://bugs.webkit.org/show_bug.cgi?id=167386
+
+        Reviewed by Mark Lam.
+
+        * stress/atomics-neg-zero.js: Added.
+
 2017-01-23  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+        -0 is a valid array index and AtomicsObject should know this
+        https://bugs.webkit.org/show_bug.cgi?id=167386
+
+        Reviewed by Mark Lam.
+
+        * runtime/AtomicsObject.cpp: The bug title really says it all.
+
 2017-01-24  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/runtime/AtomicsObject.cpp

@@ -109 +109 @@
     JSValue accessIndexValue = exec->argument(1);
     if (UNLIKELY(!accessIndexValue.isInt32())) {
-        accessIndexValue = jsNumber(accessIndexValue.toNumber(exec));
+        double accessIndexDouble = accessIndexValue.toNumber(exec);
         RETURN_IF_EXCEPTION(scope, 0);
-        if (!accessIndexValue.isInt32()) {
-            throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
-            return 0;
+        if (accessIndexDouble == 0)
+            accessIndexValue = jsNumber(0);
+        else {
+            accessIndexValue = jsNumber(accessIndexDouble);
+            if (!accessIndexValue.isInt32()) {
+                throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
+                return 0;
+            }
         }
     }