Changeset 267549 in webkit

Timestamp:

Sep 24, 2020, 3:05:31 PM (6 years ago)

Author:

Ross Kirsling

Message:

JSTests:
%TypedArray%.prototype.{map, filter} should perform TypedArraySpeciesCreate correctly
​https://bugs.webkit.org/show_bug.cgi?id=216938

Reviewed by Yusuke Suzuki.

• stress/typedarray-slice.js:

Fix test.

• test262/expectations.yaml:

Mark ten test cases as passing.

Source/JavaScriptCore:
%TypedArray% methods should perform TypedArraySpeciesCreate correctly
​https://bugs.webkit.org/show_bug.cgi?id=216938

Reviewed by Yusuke Suzuki.

map, filter, and slice are obliged to throw when:

1. this.constructor is defined but not an object
2. the species constructor produces a valid typed array which is shorter than the expected length

• builtins/TypedArrayPrototype.js:

(map):
(filter):

• runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncSlice):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/typedarray-slice.js (modified) (1 diff)
• JSTests/test262/expectations.yaml (modified) (2 diffs)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/builtins/TypedArrayPrototype.js (modified) (2 diffs)
• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%.prototype.{map, filter} should perform TypedArraySpeciesCreate correctly
+        https://bugs.webkit.org/show_bug.cgi?id=216938
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/typedarray-slice.js:
+        Fix test.
+
+        * test262/expectations.yaml:
+        Mark ten test cases as passing.
+
 2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/JSTests/stress/typedarray-slice.js

@@ -115 +115 @@
 function testSpeciesWithSameBuffer(unused, constructor) {
     return typedArrays.every(function(speciesConstructor) {
+        // This test is not valid for all type pairs.
+        if (constructor.BYTES_PER_ELEMENT < speciesConstructor.BYTES_PER_ELEMENT)
+            return true;
+
         constructor[Symbol.species] = function() { return new speciesConstructor(buffer); };
         let array = new constructor(buffer);

trunk/JSTests/test262/expectations.yaml

@@ -1246 +1246 @@
 test/built-ins/ThrowTypeError/unique-per-realm-non-simple.js:
   default: 'Test262Error: callee.get Expected SameValue(«function () {'
-test/built-ins/TypedArray/prototype/filter/speciesctor-get-ctor-returns-throws.js:
-  default: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-  strict mode: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/filter/speciesctor-get-species-custom-ctor-length-throws.js:
-  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/map/speciesctor-get-ctor-returns-throws.js:
-  default: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-  strict mode: 'Test262Error: 42 Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/map/speciesctor-get-species-custom-ctor-length-throws.js:
-  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
 test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-other-targettype.js:
   default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
@@ -1264 +1252 @@
   default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
   strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/slice/speciesctor-get-species-custom-ctor-length-throws.js:
-  default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-  strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
 test/built-ins/TypedArray/prototype/sort/comparefn-nonfunction-call-throws.js:
   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray% methods should perform TypedArraySpeciesCreate correctly
+        https://bugs.webkit.org/show_bug.cgi?id=216938
+
+        Reviewed by Yusuke Suzuki.
+
+        map, filter, and slice are obliged to throw when:
+        1. this.constructor is defined but not an object
+        2. the species constructor produces a valid typed array which is shorter than the expected length
+
+        * builtins/TypedArrayPrototype.js:
+        (map):
+        (filter):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+
 2020-09-24  Basuke Suzuki  <basuke.suzuki@sony.com>
 

trunk/Source/JavaScriptCore/builtins/TypedArrayPrototype.js

@@ -312 +312 @@
     var thisArg = @argument(1);
 
-    // Do species construction
-    var constructor = this.constructor;
-    var result;
-    if (constructor === @undefined)
-        result = new (@typedArrayGetOriginalConstructor(this))(length);
-    else {
-        var speciesConstructor = constructor.@@species;
-        if (@isUndefinedOrNull(speciesConstructor))
-            result = new (@typedArrayGetOriginalConstructor(this))(length);
-        else {
-            result = new speciesConstructor(length);
-            // typedArrayLength throws if it doesn't get a view.
-            @typedArrayLength(result);
-        }
-    }
+    var constructor = @typedArraySpeciesConstructor(this);
+    var result = new constructor(length);
+    if (@typedArrayLength(result) < length)
+        @throwTypeError("TypedArray.prototype.map constructed typed array of insufficient length");
 
     for (var i = 0; i < length; i++) {
@@ -352 +341 @@
             kept.@push(value);
     }
-
-    var constructor = this.constructor;
-    var result;
-    var resultLength = kept.length;
-    if (constructor === @undefined)
-        result = new (@typedArrayGetOriginalConstructor(this))(resultLength);
-    else {
-        var speciesConstructor = constructor.@@species;
-        if (@isUndefinedOrNull(speciesConstructor))
-            result = new (@typedArrayGetOriginalConstructor(this))(resultLength);
-        else {
-            result = new speciesConstructor(resultLength);
-            // typedArrayLength throws if it doesn't get a view.
-            @typedArrayLength(result);
-        }
-    }
-
-    for (var i = 0; i < kept.length; i++)
+    var length = kept.length;
+
+    var constructor = @typedArraySpeciesConstructor(this);
+    var result = new constructor(length);
+    if (@typedArrayLength(result) < length)
+        @throwTypeError("TypedArray.prototype.filter constructed typed array of insufficient length");
+
+    for (var i = 0; i < length; i++)
         result[i] = kept[i];
 

trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

@@ -465 +465 @@
 
     // The species constructor may return an array with any arbitrary length.
-    length = std::min(length, result->length());
+    if (result->length() < length)
+        return throwVMTypeError(globalObject, scope, "TypedArray.prototype.slice constructed typed array of insufficient length"_s);
+
     switch (result->classInfo(vm)->typedArrayStorageType) {
     case TypeInt8: