Changeset 267522 in webkit

Timestamp:

Sep 24, 2020, 12:35:30 AM (6 years ago)

Author:

Ross Kirsling

Message:

%TypedArray%.prototype.fill must only evaluate its argument once
​https://bugs.webkit.org/show_bug.cgi?id=216912

Reviewed by Yusuke Suzuki.

JSTests:

• stress/typedarray-fill.js:

Fix test.

• test262/expectations.yaml:

Mark two test cases as passing.

Source/JavaScriptCore:

Currently, we evaluate the argument in typedArray.fill({ valueOf() { ... } }) once per filled element,
but it should only be evaluated once in total.

• builtins/TypedArrayPrototype.js:

(fill):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/typedarray-fill.js (modified) (1 diff)
• JSTests/test262/expectations.yaml (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/builtins/TypedArrayPrototype.js (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%.prototype.fill must only evaluate its argument once
+        https://bugs.webkit.org/show_bug.cgi?id=216912
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/typedarray-fill.js:
+        Fix test.
+
+        * test262/expectations.yaml:
+        Mark two test cases as passing.
+
 2020-09-23  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/JSTests/stress/typedarray-fill.js

@@ -42 +42 @@
     }});
     new constructor(10).fill(p);
-    shouldBeTrue("count === 40");
+    shouldBeTrue("count === 4");
 }
 

trunk/JSTests/test262/expectations.yaml

@@ -1246 +1246 @@
 test/built-ins/ThrowTypeError/unique-per-realm-non-simple.js:
   default: 'Test262Error: callee.get Expected SameValue(«function () {'
-test/built-ins/TypedArray/prototype/fill/fill-values-conversion-once.js:
-  default: 'Test262Error: additional unexpected ToNumber() calls Expected SameValue(«3», «2») to be true (Testing with Float64Array.)'
-  strict mode: 'Test262Error: additional unexpected ToNumber() calls Expected SameValue(«3», «2») to be true (Testing with Float64Array.)'
 test/built-ins/TypedArray/prototype/filter/speciesctor-get-ctor-returns-throws.js:
   default: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%.prototype.fill must only evaluate its argument once
+        https://bugs.webkit.org/show_bug.cgi?id=216912
+
+        Reviewed by Yusuke Suzuki.
+
+        Currently, we evaluate the argument in `typedArray.fill({ valueOf() { ... } })` once per filled element,
+        but it should only be evaluated once in total.
+
+        * builtins/TypedArrayPrototype.js:
+        (fill):
+
 2020-09-23  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/builtins/TypedArrayPrototype.js

@@ -92 +92 @@
     var length = @typedArrayLength(this);
 
-    var start = @argument(1);
-    var end = @argument(2);
-
-    start = @typedArrayClampArgumentToStartOrEnd(start, length, 0);
-    end = @typedArrayClampArgumentToStartOrEnd(end, length, length);
+    var number = @toNumber(value);
+
+    var start = @typedArrayClampArgumentToStartOrEnd(@argument(1), length, 0);
+    var end = @typedArrayClampArgumentToStartOrEnd(@argument(2), length, length);
 
     for (var i = start; i < end; i++)
-        this[i] = value;
+        this[i] = number;
     return this;
 }