Changeset 267559 in webkit

Timestamp:

Sep 24, 2020, 10:40:25 PM (6 years ago)

Author:

Ross Kirsling

Message:

%TypedArray%.prototype.toLocaleString must make conscious use of @toString
​https://bugs.webkit.org/show_bug.cgi?id=216956

Reviewed by Yusuke Suzuki.

JSTests:

• test262/expectations.yaml:

Mark four test cases as passing.

Source/JavaScriptCore:

A fascinating bug: if we override Number.prototype.toLocaleString to return { valueOf() { ... } },
then we can observe our %TypedArray%.prototype.toLocaleString resolving its element values in the wrong order.

• builtins/TypedArrayPrototype.js:

(toLocaleString):
Wrap the toLocaleString call for each element in @toString(), as the spec indicates.

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/test262/expectations.yaml (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/builtins/TypedArrayPrototype.js (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%.prototype.toLocaleString must make conscious use of @toString
+        https://bugs.webkit.org/show_bug.cgi?id=216956
+
+        Reviewed by Yusuke Suzuki.
+
+        * test262/expectations.yaml:
+        Mark four test cases as passing.
+
 2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/JSTests/test262/expectations.yaml

@@ -1252 +1252 @@
   default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
   strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/toLocaleString/calls-tostring-from-each-value.js:
-  default: 'Test262Error: should not call valueOf if toString is present (Testing with Float64Array.)'
-  strict mode: 'Test262Error: should not call valueOf if toString is present (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/toLocaleString/calls-valueof-from-each-value.js:
-  default: 'Test262Error: returns expected value Expected SameValue(«hacks2,hacks1», «hacks1,hacks2») to be true (Testing with Float64Array.)'
-  strict mode: 'Test262Error: returns expected value Expected SameValue(«hacks2,hacks1», «hacks1,hacks2») to be true (Testing with Float64Array.)'
 test/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-detachbuffer.js:
   default: 'Test262Error: Expected a TypeError but got a RangeError (Testing with Float64Array.)'

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%.prototype.toLocaleString must make conscious use of @toString
+        https://bugs.webkit.org/show_bug.cgi?id=216956
+
+        Reviewed by Yusuke Suzuki.
+
+        A fascinating bug: if we override Number.prototype.toLocaleString to return { valueOf() { ... } },
+        then we can observe our %TypedArray%.prototype.toLocaleString resolving its element values in the wrong order.
+
+        * builtins/TypedArrayPrototype.js:
+        (toLocaleString):
+        Wrap the toLocaleString call for each element in @toString(), as the spec indicates.
+
 2020-09-24  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/builtins/TypedArrayPrototype.js

@@ -365 +365 @@
         return "";
 
-    var string = this[0].toLocaleString(@argument(0), @argument(1));
+    var string = @toString(this[0].toLocaleString(@argument(0), @argument(1)));
     for (var i = 1; i < length; i++)
-        string += "," + this[i].toLocaleString(@argument(0), @argument(1));
+        string += "," + @toString(this[i].toLocaleString(@argument(0), @argument(1)));
 
     return string;