Changeset 270371 in webkit

Timestamp:

Dec 2, 2020 2:57:13 PM (20 months ago)

Author:

Ross Kirsling

Message:

%TypedArray%#slice shouldn't care about source buffer detachment if there's nothing to copy
​https://bugs.webkit.org/show_bug.cgi?id=219451

Reviewed by Yusuke Suzuki.

JSTests:

• test262/expectations.yaml:

Mark four test cases as passing.

Source/JavaScriptCore:

From ​https://tc39.es/ecma262/#sec-%typedarray%.prototype.slice:

13. Let A be ? TypedArraySpeciesCreate(O, « 𝔽(count) »).
14. If count > 0, then
    1. If IsDetachedBuffer(O.ViewedArrayBuffer?) is true, throw a TypeError exception. ...
15. Return A.

We had step 14.a raised above 14; this patch fixes the ordering.

• runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncSlice):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/test262/expectations.yaml (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-12-02  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%#slice shouldn't care about source buffer detachment if there's nothing to copy
+        https://bugs.webkit.org/show_bug.cgi?id=219451
+
+        Reviewed by Yusuke Suzuki.
+
+        * test262/expectations.yaml:
+        Mark four test cases as passing.
+
 2020-12-02  Dmitry Bezhetskov  <dbezhetskov@igalia.com>
 

trunk/JSTests/test262/expectations.yaml

@@ -833 +833 @@
   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
   strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-other-targettype.js:
-  default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-  strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-test/built-ins/TypedArray/prototype/slice/detached-buffer-zero-count-custom-ctor-same-targettype.js:
-  default: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
-  strict mode: 'TypeError: Underlying ArrayBuffer has been detached from the view (Testing with Float64Array.)'
 test/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-detachbuffer.js:
   default: 'Test262Error: Expected a TypeError but got a RangeError (Testing with Float64Array.)'

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-12-02  Ross Kirsling  <ross.kirsling@sony.com>
+
+        %TypedArray%#slice shouldn't care about source buffer detachment if there's nothing to copy
+        https://bugs.webkit.org/show_bug.cgi?id=219451
+
+        Reviewed by Yusuke Suzuki.
+
+        From https://tc39.es/ecma262/#sec-%typedarray%.prototype.slice:
+          13. Let A be ? TypedArraySpeciesCreate(O, « 𝔽(count) »).
+          14. If count > 0, then
+            a. If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+            ...
+          15. Return A.
+
+        We had step 14.a raised above 14; this patch fixes the ordering.
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+
 2020-12-02  Dmitry Bezhetskov  <dbezhetskov@igalia.com>
 

trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

@@ -453 +453 @@
     });
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
-
     ASSERT(!result->isDetached());
-    if (thisObject->isDetached())
-        return throwVMTypeError(globalObject, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     // We return early here since we don't allocate a backing store if length is 0 and memmove does not like nullptrs
     if (!length)
         return JSValue::encode(result);
+
+    if (thisObject->isDetached())
+        return throwVMTypeError(globalObject, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     // The species constructor may return an array with any arbitrary length.