⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245917 in webkit


Ignore:
Timestamp:
May 30, 2019, 5:29:49 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r244950. rdar://problem/51265731

TypedArrays should not store properties that are canonical numeric indices
​https://bugs.webkit.org/show_bug.cgi?id=197228
<rdar://problem/49557381>

Reviewed by Saam Barati.

JSTests:

  • stress/array-species-config-array-constructor.js: (test):
  • stress/put-direct-index-broken-2.js:
  • stress/typed-array-canonical-numeric-index-string.js: Added. (makeTest.assert): (makeTest): (const.testInvalidIndices.makeTest.set assert): (const.testInvalidIndices.makeTest): (const.makeTestValidIndex.configurable.set assert): (const.makeTestValidIndex.configurable):
  • stress/typedarray-access-monomorphic-neutered.js: (checkNoException): (testNoException): (testFTLNoException):
  • stress/typedarray-access-neutered.js: (testNoException):
  • stress/typedarray-getownproperty-not-configurable.js: (foo):
  • test262/expectations.yaml:

Source/JavaScriptCore:

According to the spec[1]:

  • TypedArrays should not perform an ordinary GetOwnProperty/SetOwnProperty if the index is a CanonicalNumericIndexString, but invalid according to IntegerIndexedElementGet and similar functions. I.e., there are a few properties that should not be set in a TypedArray, like NaN, Infinity and -0.
  • On DefineOwnProperty, the out-of-bounds check should be performed before validating the property descriptor.
  • On GetOwnProperty, the returned descriptor for numeric properties should have writable set to true.

[1]: ​https://www.ecma-international.org/ecma-262/9.0/index.html#sec-integer-indexed-exotic-objects-defineownproperty-p-desc

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot): (JSC::JSGenericTypedArrayView<Adaptor>::put): (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty): (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex): (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
  • runtime/PropertyName.h: (JSC::isCanonicalNumericIndexString):

LayoutTests:

  • fast/canvas/canvas-ImageData-behaviour-expected.txt:
  • fast/canvas/canvas-ImageData-behaviour.js:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@244950 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch
Files:
1 added
15 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/JSTests/ChangeLog

    r245352 r245917  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r244950. rdar://problem/51265731
     4
     5    TypedArrays should not store properties that are canonical numeric indices
     6    https://bugs.webkit.org/show_bug.cgi?id=197228
     7    <rdar://problem/49557381>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    JSTests:
     12   
     13    * stress/array-species-config-array-constructor.js:
     14    (test):
     15    * stress/put-direct-index-broken-2.js:
     16    * stress/typed-array-canonical-numeric-index-string.js: Added.
     17    (makeTest.assert):
     18    (makeTest):
     19    (const.testInvalidIndices.makeTest.set assert):
     20    (const.testInvalidIndices.makeTest):
     21    (const.makeTestValidIndex.configurable.set assert):
     22    (const.makeTestValidIndex.configurable):
     23    * stress/typedarray-access-monomorphic-neutered.js:
     24    (checkNoException):
     25    (testNoException):
     26    (testFTLNoException):
     27    * stress/typedarray-access-neutered.js:
     28    (testNoException):
     29    * stress/typedarray-getownproperty-not-configurable.js:
     30    (foo):
     31    * test262/expectations.yaml:
     32   
     33    Source/JavaScriptCore:
     34   
     35    According to the spec[1]:
     36    - TypedArrays should not perform an ordinary GetOwnProperty/SetOwnProperty if the index is a
     37    CanonicalNumericIndexString, but invalid according to IntegerIndexedElementGet and similar
     38    functions. I.e., there are a few properties that should not be set in a TypedArray, like NaN,
     39    Infinity and -0.
     40    - On DefineOwnProperty, the out-of-bounds check should be performed before validating the property
     41    descriptor.
     42    - On GetOwnProperty, the returned descriptor for numeric properties should have writable set to true.
     43   
     44    [1]: https://www.ecma-international.org/ecma-262/9.0/index.html#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
     45   
     46    * CMakeLists.txt:
     47    * JavaScriptCore.xcodeproj/project.pbxproj:
     48    * runtime/JSGenericTypedArrayViewInlines.h:
     49    (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
     50    (JSC::JSGenericTypedArrayView<Adaptor>::put):
     51    (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
     52    (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
     53    (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
     54    * runtime/PropertyName.h:
     55    (JSC::isCanonicalNumericIndexString):
     56   
     57    LayoutTests:
     58   
     59    * fast/canvas/canvas-ImageData-behaviour-expected.txt:
     60    * fast/canvas/canvas-ImageData-behaviour.js:
     61   
     62   
     63    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     64
     65    2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>
     66
     67            TypedArrays should not store properties that are canonical numeric indices
     68            https://bugs.webkit.org/show_bug.cgi?id=197228
     69            <rdar://problem/49557381>
     70
     71            Reviewed by Saam Barati.
     72
     73            * stress/array-species-config-array-constructor.js:
     74            (test):
     75            * stress/put-direct-index-broken-2.js:
     76            * stress/typed-array-canonical-numeric-index-string.js: Added.
     77            (makeTest.assert):
     78            (makeTest):
     79            (const.testInvalidIndices.makeTest.set assert):
     80            (const.testInvalidIndices.makeTest):
     81            (const.makeTestValidIndex.configurable.set assert):
     82            (const.makeTestValidIndex.configurable):
     83            * stress/typedarray-access-monomorphic-neutered.js:
     84            (checkNoException):
     85            (testNoException):
     86            (testFTLNoException):
     87            * stress/typedarray-access-neutered.js:
     88            (testNoException):
     89            * stress/typedarray-getownproperty-not-configurable.js:
     90            (foo):
     91            * test262/expectations.yaml:
     92
    1932019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
    294

  • branches/safari-607-branch/JSTests/stress/array-species-config-array-constructor.js

    r216279 r245917  
    3333function test() {
    3434    const message = "TypeError: Attempting to configure non-configurable property on a typed array at index: 0";
    35     shouldThrow(() => foo.concat([1]), message);
     35    foo.concat([1]);
    3636    foo = [1,2,3,4];
    3737    shouldThrow(() => foo.slice(0), message);

  • branches/safari-607-branch/JSTests/stress/put-direct-index-broken-2.js

    r232525 r245917  
    5858        err = e;
    5959    }
    60     assert(err.toString() ===  "TypeError: Attempting to configure non-configurable property on a typed array at index: 0");
     60    assert(!err);
    6161});
    6262

  • branches/safari-607-branch/JSTests/stress/typedarray-access-monomorphic-neutered.js

    r203096 r245917  
    2929    test("delete array[0]", array);
    3030    test("Object.getOwnPropertyDescriptor(array, 0)", array);
    31     test("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true })", array);
    3231    test("array[0] = 1", array);
    3332    test("array[i] = 1", array);
    … …  
    4948    testFTL("delete array[0]", array, failArray);
    5049    testFTL("Object.getOwnPropertyDescriptor(array, 0)", array, failArray);
    51     testFTL("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true })", array, failArray);
    5250    testFTL("array[0] = 1", array, failArray);
    5351    testFTL("array[i] = 1", array, failArray);
    5452}
     53
     54
     55function checkNoException(array, thunk, count) {
     56    thunk(array, count);
     57}
     58noInline(check);
     59
     60function testNoException(thunk, array) {
     61    let fn = Function("array", "i", thunk);
     62    noInline(fn);
     63    for (let i = 0; i < 10000; i++)
     64        checkNoException(array, fn, i);
     65}
     66
     67for (let constructor of typedArrays) {
     68    let array = new constructor(10);
     69    transferArrayBuffer(array.buffer);
     70    testNoException("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true })", array);
     71}
     72
     73function testFTLNoException(thunk, array, failArray) {
     74    let fn = Function("array", "i", thunk);
     75    noInline(fn);
     76    for (let i = 0; i < 10000; i++)
     77        fn(array, i)
     78    checkNoException(failArray, fn, 10000);
     79}
     80for (let constructor of typedArrays) {
     81    let array = new constructor(10);
     82    let failArray = new constructor(10);
     83    transferArrayBuffer(failArray.buffer);
     84    testFTLNoException("Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true })", array, failArray);
     85}

  • branches/safari-607-branch/JSTests/stress/typedarray-access-neutered.js

    r203096 r245917  
    2626    test((array) => delete array[0], i);
    2727    test((array) => Object.getOwnPropertyDescriptor(array, 0), i);
    28     test((array) => Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true }), i)
    2928    test((array) => array[0] = 1, i);
    3029}
     30
     31function checkNoException(thunk, count) {
     32    let array = new constructor(10);
     33    transferArrayBuffer(array.buffer);
     34    thunk(array);
     35}
     36
     37function testNoException(thunk, count) {
     38    for (constructor of typedArrays)
     39        checkNoException(thunk, count);
     40}
     41
     42for (let i = 0; i < 10000; i++) {
     43    testNoException((array) => Object.defineProperty(array, 0, { value: 1, writable: true, configurable: false, enumerable: true }), i)
     44}

  • branches/safari-607-branch/JSTests/stress/typedarray-getownproperty-not-configurable.js

    r220377 r245917  
    1111        let b = Object.getOwnPropertyDescriptor(a, 0);
    1212        assert(b.value === 0);
    13         assert(b.writable === false);
     13        assert(b.writable === true);
    1414        assert(b.enumerable === true);
    1515        assert(b.configurable === false);

  • branches/safari-607-branch/JSTests/test262/expectations.yaml

    r239605 r245917  
    14161416  default: 'Test262Error: Expected a Test262Error but got a TypeError (Testing with Float64Array.)'
    14171417  strict mode: 'Test262Error: Expected a Test262Error but got a TypeError (Testing with Float64Array.)'
     1418test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-realm.js:
     1419  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
     1420  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14181421test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer.js:
    1419   default: 'Test262Error: Return false before Detached Buffer check when value is a negative number Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1420   strict mode: 'Test262Error: Return false before Detached Buffer check when value is a negative number Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1421 test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-lower-than-zero.js:
    1422   default: 'Test262Error: -1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1423   strict mode: 'Test262Error: -1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1424 test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-minus-zero.js:
    1425   default: 'Test262Error: defineProperty returns false Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1426   strict mode: 'Test262Error: defineProperty returns false Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1427 test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-not-integer.js:
    1428   default: 'Test262Error: 0.1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1429   strict mode: 'Test262Error: 0.1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1430 test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/key-is-numericindex.js:
    1431   default: 'Test262Error: property is writable Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
    1432   strict mode: 'Test262Error: property is writable Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
     1422  default: 'Test262Error: Throws TypeError on valid numeric index if instance has a detached buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
     1423  strict mode: 'Test262Error: Throws TypeError on valid numeric index if instance has a detached buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14331424test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/set-value.js:
    14341425  default: 'Test262Error: set value for sample[0] returns true Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
    … …  
    14371428  default: 'Test262Error: detaching a ArrayBuffer during defining an element of a typed array viewing it should throw Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14381429  strict mode: 'Test262Error: detaching a ArrayBuffer during defining an element of a typed array viewing it should throw Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1439 test/built-ins/TypedArrayConstructors/internals/Get/detached-buffer.js:
    1440   default: 'Test262Error: detach buffer runs before checking for 1.1 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1441   strict mode: 'Test262Error: detach buffer runs before checking for 1.1 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1442 test/built-ins/TypedArrayConstructors/internals/Get/infinity-detached-buffer.js:
    1443   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1444   strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14451430test/built-ins/TypedArrayConstructors/internals/Get/key-is-not-integer.js:
    14461431  default: 'Test262Error: OrdinaryGet was called! Ref: 9.1.8.1 3.c (Testing with Float64Array.)'
    … …  
    14551440  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14561441  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1457 test/built-ins/TypedArrayConstructors/internals/GetOwnProperty/index-prop-desc.js:
    1458   default: 'Test262Error: index descriptor is writable [0] Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
    1459   strict mode: 'Test262Error: index descriptor is writable [0] Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
    14601442test/built-ins/TypedArrayConstructors/internals/HasProperty/abrupt-from-ordinary-has-parent-hasproperty.js:
    14611443  default: 'Test262Error:  (Testing with Float64Array.)'
    … …  
    14671449  default: 'Test262Error: 0 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14681450  strict mode: 'Test262Error: 0 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1469 test/built-ins/TypedArrayConstructors/internals/HasProperty/infinity-with-detached-buffer.js:
    1470   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    14711451test/built-ins/TypedArrayConstructors/internals/HasProperty/inherited-property.js:
    14721452  default: 'Test262Error: 42 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    … …  
    14841464  default: 'Test262Error: 1.1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    14851465  strict mode: 'Test262Error: 1.1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1486 test/built-ins/TypedArrayConstructors/internals/Set/detached-buffer.js:
    1487   default: 'Test262Error: detach buffer runs before checking for 1.1 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1488   strict mode: 'Test262Error: detach buffer runs before checking for 1.1 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
    1489 test/built-ins/TypedArrayConstructors/internals/Set/key-is-minus-zero.js:
    1490   default: 'Test262Error: -0 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1491   strict mode: 'Test262Error: -0 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1492 test/built-ins/TypedArrayConstructors/internals/Set/key-is-not-integer.js:
    1493   default: 'Test262Error: 1.1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1494   strict mode: 'Test262Error: 1.1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1495 test/built-ins/TypedArrayConstructors/internals/Set/key-is-out-of-bounds.js:
    1496   default: 'Test262Error: -1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    1497   strict mode: 'Test262Error: -1 Expected SameValue(«true», «false») to be true (Testing with Float64Array.)'
    14981466test/built-ins/TypedArrayConstructors/internals/Set/tonumber-value-throws.js:
    14991467  default: 'Test262Error: ToNumber runs before ToInteger(index) Expected a Test262Error to be thrown but no exception was thrown at all (Testing with Float64Array.)'

  • branches/safari-607-branch/LayoutTests/ChangeLog

    r245916 r245917  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r244950. rdar://problem/51265731
     4
     5    TypedArrays should not store properties that are canonical numeric indices
     6    https://bugs.webkit.org/show_bug.cgi?id=197228
     7    <rdar://problem/49557381>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    JSTests:
     12   
     13    * stress/array-species-config-array-constructor.js:
     14    (test):
     15    * stress/put-direct-index-broken-2.js:
     16    * stress/typed-array-canonical-numeric-index-string.js: Added.
     17    (makeTest.assert):
     18    (makeTest):
     19    (const.testInvalidIndices.makeTest.set assert):
     20    (const.testInvalidIndices.makeTest):
     21    (const.makeTestValidIndex.configurable.set assert):
     22    (const.makeTestValidIndex.configurable):
     23    * stress/typedarray-access-monomorphic-neutered.js:
     24    (checkNoException):
     25    (testNoException):
     26    (testFTLNoException):
     27    * stress/typedarray-access-neutered.js:
     28    (testNoException):
     29    * stress/typedarray-getownproperty-not-configurable.js:
     30    (foo):
     31    * test262/expectations.yaml:
     32   
     33    Source/JavaScriptCore:
     34   
     35    According to the spec[1]:
     36    - TypedArrays should not perform an ordinary GetOwnProperty/SetOwnProperty if the index is a
     37    CanonicalNumericIndexString, but invalid according to IntegerIndexedElementGet and similar
     38    functions. I.e., there are a few properties that should not be set in a TypedArray, like NaN,
     39    Infinity and -0.
     40    - On DefineOwnProperty, the out-of-bounds check should be performed before validating the property
     41    descriptor.
     42    - On GetOwnProperty, the returned descriptor for numeric properties should have writable set to true.
     43   
     44    [1]: https://www.ecma-international.org/ecma-262/9.0/index.html#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
     45   
     46    * CMakeLists.txt:
     47    * JavaScriptCore.xcodeproj/project.pbxproj:
     48    * runtime/JSGenericTypedArrayViewInlines.h:
     49    (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
     50    (JSC::JSGenericTypedArrayView<Adaptor>::put):
     51    (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
     52    (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
     53    (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
     54    * runtime/PropertyName.h:
     55    (JSC::isCanonicalNumericIndexString):
     56   
     57    LayoutTests:
     58   
     59    * fast/canvas/canvas-ImageData-behaviour-expected.txt:
     60    * fast/canvas/canvas-ImageData-behaviour.js:
     61   
     62   
     63    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     64
     65    2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>
     66
     67            TypedArrays should not store properties that are canonical numeric indices
     68            https://bugs.webkit.org/show_bug.cgi?id=197228
     69            <rdar://problem/49557381>
     70
     71            Reviewed by Saam Barati.
     72
     73            * fast/canvas/canvas-ImageData-behaviour-expected.txt:
     74            * fast/canvas/canvas-ImageData-behaviour.js:
     75
    1762019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    277

  • branches/safari-607-branch/LayoutTests/fast/canvas/canvas-ImageData-behaviour-expected.txt

    r126023 r245917  
    4444PASS imageData.data[0] = undefined, imageData.data[0] is 0
    4545PASS imageData.data['foo']='garbage',imageData.data['foo'] is 'garbage'
    46 PASS imageData.data[-1]='garbage',imageData.data[-1] is 'garbage'
     46PASS imageData.data[-1]='garbage',imageData.data[-1] is undefined
    4747PASS imageData.data[17]='garbage',imageData.data[17] is undefined
    4848PASS successfullyParsed is true

  • branches/safari-607-branch/LayoutTests/fast/canvas/canvas-ImageData-behaviour.js

    r126023 r245917  
    2222
    2323shouldBe("imageData.data['foo']='garbage',imageData.data['foo']", "'garbage'");
    24 shouldBe("imageData.data[-1]='garbage',imageData.data[-1]", "'garbage'");
     24shouldBe("imageData.data[-1]='garbage',imageData.data[-1]", "undefined");
    2525shouldBe("imageData.data[17]='garbage',imageData.data[17]", "undefined");

  • branches/safari-607-branch/Source/JavaScriptCore/CMakeLists.txt

    r240375 r245917  
    832832    runtime/JSGlobalLexicalEnvironment.h
    833833    runtime/JSGlobalObject.h
     834    runtime/JSGlobalObjectFunctions.h
    834835    runtime/JSGlobalObjectInlines.h
    835836    runtime/JSInternalPromise.h

  • branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

    r245352 r245917  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r244950. rdar://problem/51265731
     4
     5    TypedArrays should not store properties that are canonical numeric indices
     6    https://bugs.webkit.org/show_bug.cgi?id=197228
     7    <rdar://problem/49557381>
     8   
     9    Reviewed by Saam Barati.
     10   
     11    JSTests:
     12   
     13    * stress/array-species-config-array-constructor.js:
     14    (test):
     15    * stress/put-direct-index-broken-2.js:
     16    * stress/typed-array-canonical-numeric-index-string.js: Added.
     17    (makeTest.assert):
     18    (makeTest):
     19    (const.testInvalidIndices.makeTest.set assert):
     20    (const.testInvalidIndices.makeTest):
     21    (const.makeTestValidIndex.configurable.set assert):
     22    (const.makeTestValidIndex.configurable):
     23    * stress/typedarray-access-monomorphic-neutered.js:
     24    (checkNoException):
     25    (testNoException):
     26    (testFTLNoException):
     27    * stress/typedarray-access-neutered.js:
     28    (testNoException):
     29    * stress/typedarray-getownproperty-not-configurable.js:
     30    (foo):
     31    * test262/expectations.yaml:
     32   
     33    Source/JavaScriptCore:
     34   
     35    According to the spec[1]:
     36    - TypedArrays should not perform an ordinary GetOwnProperty/SetOwnProperty if the index is a
     37    CanonicalNumericIndexString, but invalid according to IntegerIndexedElementGet and similar
     38    functions. I.e., there are a few properties that should not be set in a TypedArray, like NaN,
     39    Infinity and -0.
     40    - On DefineOwnProperty, the out-of-bounds check should be performed before validating the property
     41    descriptor.
     42    - On GetOwnProperty, the returned descriptor for numeric properties should have writable set to true.
     43   
     44    [1]: https://www.ecma-international.org/ecma-262/9.0/index.html#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
     45   
     46    * CMakeLists.txt:
     47    * JavaScriptCore.xcodeproj/project.pbxproj:
     48    * runtime/JSGenericTypedArrayViewInlines.h:
     49    (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
     50    (JSC::JSGenericTypedArrayView<Adaptor>::put):
     51    (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
     52    (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
     53    (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
     54    * runtime/PropertyName.h:
     55    (JSC::isCanonicalNumericIndexString):
     56   
     57    LayoutTests:
     58   
     59    * fast/canvas/canvas-ImageData-behaviour-expected.txt:
     60    * fast/canvas/canvas-ImageData-behaviour.js:
     61   
     62   
     63    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     64
     65    2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>
     66
     67            TypedArrays should not store properties that are canonical numeric indices
     68            https://bugs.webkit.org/show_bug.cgi?id=197228
     69            <rdar://problem/49557381>
     70
     71            Reviewed by Saam Barati.
     72
     73            According to the spec[1]:
     74            - TypedArrays should not perform an ordinary GetOwnProperty/SetOwnProperty if the index is a
     75            CanonicalNumericIndexString, but invalid according to IntegerIndexedElementGet and similar
     76            functions. I.e., there are a few properties that should not be set in a TypedArray, like NaN,
     77            Infinity and -0.
     78            - On DefineOwnProperty, the out-of-bounds check should be performed before validating the property
     79            descriptor.
     80            - On GetOwnProperty, the returned descriptor for numeric properties should have writable set to true.
     81
     82            [1]: https://www.ecma-international.org/ecma-262/9.0/index.html#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
     83
     84            * CMakeLists.txt:
     85            * JavaScriptCore.xcodeproj/project.pbxproj:
     86            * runtime/JSGenericTypedArrayViewInlines.h:
     87            (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
     88            (JSC::JSGenericTypedArrayView<Adaptor>::put):
     89            (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
     90            (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
     91            (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
     92            * runtime/PropertyName.h:
     93            (JSC::isCanonicalNumericIndexString):
     94
    1952019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
    296

  • branches/safari-607-branch/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r244254 r245917  
    16351635                BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; };
    16361636                BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1637                 BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
     1637                BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; settings = {ATTRIBUTES = (Private, ); }; };
    16381638                BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
    16391639                BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9041470EB9250900FE26FA /* StructureTransitionTable.h */; settings = {ATTRIBUTES = (Private, ); }; };

  • branches/safari-607-branch/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

    r239427 r245917  
    11/*
    2  * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    352352
    353353        if (thisObject->canGetIndexQuickly(index.value())) {
    354             slot.setValue(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly, thisObject->getIndexQuickly(index.value()));
     354            slot.setValue(thisObject, static_cast<unsigned>(PropertyAttribute::DontDelete), thisObject->getIndexQuickly(index.value()));
    355355            return true;
    356356        }
    357357
    358         slot.setValue(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly, jsUndefined());
    359         return false;
    360     }
    361    
     358        return false;
     359    }
     360
     361    if (isCanonicalNumericIndexString(propertyName)) {
     362        if (thisObject->isNeutered()) {
     363            slot.setCustom(thisObject, static_cast<unsigned>(PropertyAttribute::None), throwNeuteredTypedArrayTypeError);
     364            return true;
     365        }
     366
     367        return false;
     368    }
     369
    362370    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
    363371}
    … …  
    368376    PutPropertySlot& slot)
    369377{
     378    VM& vm = exec->vm();
     379    auto scope = DECLARE_THROW_SCOPE(vm);
     380
    370381    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
    371382
    … …  
    374385    // 9.4.5.5-2-b-i Return ? IntegerIndexedElementSet(O, numericIndex, V).
    375386    if (Optional<uint32_t> index = parseIndex(propertyName))
    376         return putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
    377    
    378     return Base::put(thisObject, exec, propertyName, value, slot);
     387        RELEASE_AND_RETURN(scope, putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode()));
     388
     389    if (isCanonicalNumericIndexString(propertyName)) {
     390        if (thisObject->isNeutered())
     391            throwTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
     392        return false;
     393    }
     394
     395    RELEASE_AND_RETURN(scope, Base::put(thisObject, exec, propertyName, value, slot));
    379396}
    380397
    … …  
    395412        };
    396413
     414        if (index.value() >= thisObject->m_length)
     415            return false;
     416
    397417        if (descriptor.isAccessorDescriptor())
    398418            return throwTypeErrorIfNeeded("Attempting to store accessor property on a typed array at index: ");
    … …  
    404424            return throwTypeErrorIfNeeded("Attempting to store non-enumerable or non-writable property on a typed array at index: ");
    405425
    406         if (descriptor.value()) {
    407             PutPropertySlot unused(JSValue(thisObject), shouldThrow);
    408             RELEASE_AND_RETURN(scope, thisObject->put(thisObject, exec, propertyName, descriptor.value(), unused));
    409         }
    410         return true;
    411     }
    412    
     426        if (descriptor.value())
     427            RELEASE_AND_RETURN(scope, thisObject->putByIndex(thisObject, exec, index.value(), descriptor.value(), shouldThrow));
     428
     429        return true;
     430    }
     431
     432    if (isCanonicalNumericIndexString(propertyName))
     433        return false;
     434
    413435    RELEASE_AND_RETURN(scope, Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow));
    414436}
    … …  
    433455template<typename Adaptor>
    434456bool JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex(
    435     JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
     457    JSObject* object, ExecState*, unsigned propertyName, PropertySlot& slot)
    436458{
    437459    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
    … …  
    442464    }
    443465
    444     if (propertyName > MAX_ARRAY_INDEX) {
    445         return thisObject->methodTable(exec->vm())->getOwnPropertySlot(
    446             thisObject, exec, Identifier::from(exec, propertyName), slot);
    447     }
    448    
    449466    if (!thisObject->canGetIndexQuickly(propertyName))
    450467        return false;
    … …  
    456473template<typename Adaptor>
    457474bool JSGenericTypedArrayView<Adaptor>::putByIndex(
    458     JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
     475    JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)
    459476{
    460477    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
    461 
    462     if (propertyName > MAX_ARRAY_INDEX) {
    463         PutPropertySlot slot(JSValue(thisObject), shouldThrow);
    464         return thisObject->methodTable(exec->vm())->put(thisObject, exec, Identifier::from(exec, propertyName), value, slot);
    465     }
    466    
    467478    return thisObject->setIndex(exec, propertyName, value);
    468479}

  • branches/safari-607-branch/Source/JavaScriptCore/runtime/PropertyName.h

    r239427 r245917  
    2727
    2828#include "Identifier.h"
     29#include "JSGlobalObjectFunctions.h"
    2930#include "PrivateName.h"
    3031#include <wtf/Optional.h>
     32#include <wtf/dtoa.h>
    3133
    3234namespace JSC {
    … …  
    131133}
    132134
     135// https://www.ecma-international.org/ecma-262/9.0/index.html#sec-canonicalnumericindexstring
     136ALWAYS_INLINE bool isCanonicalNumericIndexString(const PropertyName& propertyName)
     137{
     138    StringImpl* property = propertyName.uid();
     139    if (!property)
     140        return false;
     141    if (property->isSymbol())
     142        return false;
     143    if (equal(property, "-0"))
     144        return true;
     145    double index = jsToNumber(property);
     146    NumberToStringBuffer buffer;
     147    const char* indexString = WTF::numberToString(index, buffer);
     148    if (!equal(property, indexString))
     149        return false;
     150    return true;
     151}
     152
    133153} // namespace JSC
Note: See TracChangeset for help on using the changeset viewer.