Changeset 164819 in webkit


Ignore:
Timestamp:
Feb 27, 2014 11:39:42 AM (10 years ago)
Author:
commit-queue@webkit.org
Message:

Math.{max, min}() must not return after first NaN value
​https://bugs.webkit.org/show_bug.cgi?id=104147

Patch by Tibor Meszaros <​tmeszaros.u-szeged@partner.samsung.com> on 2014-02-27
Reviewed by Oliver Hunt.

Source/JavaScriptCore:

According to the spec, ToNumber going to be called on each argument
even if a NaN value was already found

  • runtime/MathObject.cpp:

(JSC::mathProtoFuncMax):
(JSC::mathProtoFuncMin):

LayoutTests:

Extended the Math.{max, min}() tests, to check that these methods are return after first NaN value or not.

  • js/math-expected.txt:
  • js/script-tests/math.js:
Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r164807 r164819  
     12014-02-27  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
     2
     3        Math.{max, min}() must not return after first NaN value
     4        https://bugs.webkit.org/show_bug.cgi?id=104147
     5
     6        Reviewed by Oliver Hunt.
     7
     8        Extended the Math.{max, min}() tests, to check that these methods are return after first NaN value or not.
     9
     10        * js/math-expected.txt:
     11        * js/script-tests/math.js:
     12
    1132014-02-27  Chris Fleizach  <cfleizach@apple.com>
    214

  • trunk/LayoutTests/js/math-expected.txt

    r158545 r164819  
    9898PASS Math.max(-0) is -0
    9999PASS Math.max(-0, 0) is 0
     100PASS Math.max(NaN, {valueOf:function(){throw "err"}}) threw exception err.
     101PASS Math.max(NaN, NaN, {valueOf:function(){throw "err"}}) threw exception err.
     102PASS Math.max(-0, NaN, 0) is NaN
     103PASS Math.max(-0, NaN, 0, NaN) is NaN
     104PASS Math.max({valueOf:function(){throw "error1"}}, {valueOf:function(){sideEffect = 1}}) threw exception error1.
     105PASS sideEffect is 0
    100106PASS Math.min() is Infinity
    101107PASS Math.min(NaN) is NaN
    … …  
    104110PASS Math.min(-0) is -0
    105111PASS Math.min(-0, 0) is -0
     112PASS Math.min(NaN, {valueOf:function(){throw "err"}}) threw exception err.
     113PASS Math.min(NaN, NaN, {valueOf:function(){throw "err"}}) threw exception err.
     114PASS Math.min(-0, NaN, 0) is NaN
     115PASS Math.min(-0, NaN, 0, NaN) is NaN
     116PASS Math.min({valueOf:function(){throw "error1"}}, {valueOf:function(){sideEffect = 1}}) threw exception error1.
     117PASS sideEffect is 0
    106118PASS Math.pow(NaN, NaN) is NaN
    107119PASS Math.pow(NaN, 0) is 1

  • trunk/LayoutTests/js/script-tests/math.js

    r158545 r164819  
    140140shouldBe("Math.max(-0)", "-0");
    141141shouldBe("Math.max(-0, 0)", "0");
     142shouldThrow("Math.max(NaN, {valueOf:function(){throw \"err\"}})","'err'");
     143shouldThrow("Math.max(NaN, NaN, {valueOf:function(){throw \"err\"}})","'err'");
     144shouldBe("Math.max(-0, NaN, 0)", "NaN");
     145shouldBe("Math.max(-0, NaN, 0, NaN)", "NaN");
     146sideEffect = 0;
     147shouldThrow("Math.max({valueOf:function(){throw \"error1\"}}, {valueOf:function(){sideEffect = 1}})", "'error1'")
     148shouldBe('sideEffect', '0');
    142149
    143150shouldBe("Math.min()", "Infinity");
    … …  
    147154shouldBe("Math.min(-0)", "-0");
    148155shouldBe("Math.min(-0, 0)", "-0");
     156shouldThrow("Math.min(NaN, {valueOf:function(){throw \"err\"}})","'err'");
     157shouldThrow("Math.min(NaN, NaN, {valueOf:function(){throw \"err\"}})","'err'");
     158shouldBe("Math.min(-0, NaN, 0)", "NaN");
     159shouldBe("Math.min(-0, NaN, 0, NaN)", "NaN");
     160sideEffect = 0;
     161shouldThrow("Math.min({valueOf:function(){throw \"error1\"}}, {valueOf:function(){sideEffect = 1}})", "'error1'")
     162shouldBe('sideEffect', '0');
    149163
    150164shouldBe("Math.pow(NaN, NaN)", "NaN");

  • trunk/Source/JavaScriptCore/ChangeLog

    r164815 r164819  
     12014-02-27  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
     2
     3        Math.{max, min}() must not return after first NaN value
     4        https://bugs.webkit.org/show_bug.cgi?id=104147
     5
     6        Reviewed by Oliver Hunt.
     7
     8        According to the spec, ToNumber going to be called on each argument
     9        even if a `NaN` value was already found
     10
     11        * runtime/MathObject.cpp:
     12        (JSC::mathProtoFuncMax):
     13        (JSC::mathProtoFuncMin):
     14
    1152014-02-27  Gergo Balogh  <gbalogh.u-szeged@partner.samsung.com>
    216

  • trunk/Source/JavaScriptCore/runtime/MathObject.cpp

    r163844 r164819  
    189189        if (std::isnan(val)) {
    190190            result = QNaN;
    191             break;
    192         }
    193         if (val > result || (!val && !result && !std::signbit(val)))
     191        } else if (val > result || (!val && !result && !std::signbit(val)))
    194192            result = val;
    195193    }
    … …  
    205203        if (std::isnan(val)) {
    206204            result = QNaN;
    207             break;
    208         }
    209         if (val < result || (!val && !result && std::signbit(val)))
     205        } else if (val < result || (!val && !result && std::signbit(val)))
    210206            result = val;
    211207    }
Note: See TracChangeset for help on using the changeset viewer.