Changeset 246851 in webkit

Timestamp:

Jun 26, 2019 4:07:28 PM (5 years ago)

Author:

keith_miller@apple.com

Message:

speciesConstruct needs to throw if the result is a DataView
​https://bugs.webkit.org/show_bug.cgi?id=199231

Reviewed by Mark Lam.

JSTests:

• stress/typedarray-filter.js:

(subclasses.forEach):

• stress/typedarray-map.js:

(subclasses.forEach):

• stress/typedarray-slice.js:

(typedArrays.forEach):

• stress/typedarray-subarray.js:

(subclasses.forEach):

Source/JavaScriptCore:

Previously, we only checked that the result was a
JSArrayBufferView, which can include DataViews. This is incorrect
as the result should be only be a TypedArray.

• runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::speciesConstruct):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/typedarray-filter.js (modified) (2 diffs)
• JSTests/stress/typedarray-map.js (modified) (1 diff)
• JSTests/stress/typedarray-slice.js (modified) (1 diff)
• JSTests/stress/typedarray-subarray.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-06-26  Keith Miller  <keith_miller@apple.com>
+
+        speciesConstruct needs to throw if the result is a DataView
+        https://bugs.webkit.org/show_bug.cgi?id=199231
+
+        Reviewed by Mark Lam.
+
+        * stress/typedarray-filter.js:
+        (subclasses.forEach):
+        * stress/typedarray-map.js:
+        (subclasses.forEach):
+        * stress/typedarray-slice.js:
+        (typedArrays.forEach):
+        * stress/typedarray-subarray.js:
+        (subclasses.forEach):
+
 2019-06-24  Commit Queue  <commit-queue@webkit.org>
 

trunk/JSTests/stress/typedarray-filter.js

@@ -92 +92 @@
 shouldBeTrue("forEachTypedArray(subclasses, testSpeciesIsDefault)");
 
+subclasses.forEach(function(constructor) { constructor[Symbol.species] = () => new DataView(new ArrayBuffer()); });
+function testSpeciesReturnsDataView(array, constructor) {
+    try {
+        array.filter(accept);
+    } catch (e) {
+        return e instanceof TypeError;
+    }
+    return false;
+}
+shouldBeTrue("forEachTypedArray(subclasses, testSpeciesReturnsDataView)");
+
 subclasses = typedArrays.map(function(constructor) { return class extends constructor { } } );
 function testSpeciesRemoveConstructor(array, constructor) {
@@ -101 +112 @@
 
 shouldBeTrue("forEachTypedArray(subclasses, testSpeciesRemoveConstructor)");
+
 finishJSTest();

trunk/JSTests/stress/typedarray-map.js

@@ -91 +91 @@
 shouldBeTrue("forEachTypedArray(subclasses, testSpeciesIsDefault)");
 
+subclasses.forEach(function(constructor) { constructor[Symbol.species] = () => new DataView(new ArrayBuffer()); });
+function testSpeciesReturnsDataView(array, constructor) {
+    try {
+        array.map(id);
+    } catch (e) {
+        return e instanceof TypeError;
+    }
+    return false;
+}
+shouldBeTrue("forEachTypedArray(subclasses, testSpeciesReturnsDataView)");
+
 subclasses = typedArrays.map(function(constructor) { return class extends constructor { } } );
 function testSpeciesRemoveConstructor(array, constructor) {

trunk/JSTests/stress/typedarray-slice.js

@@ -170 +170 @@
 shouldBeTrue("forEachTypedArray(typedArrays, testSpeciesWithTransferring)");
 
+typedArrays.forEach(function(constructor) { constructor[Symbol.species] = () => new DataView(new ArrayBuffer()); });
+function testSpeciesReturnsDataView(array, constructor) {
+    try {
+        array.slice(0, 1);
+    } catch (e) {
+        return e instanceof TypeError;
+    }
+    return false;
+}
+shouldBeTrue("forEachTypedArray(typedArrays, testSpeciesReturnsDataView)");
+
 finishJSTest();

trunk/JSTests/stress/typedarray-subarray.js

@@ -49 +49 @@
 shouldBeTrue("forEachTypedArray(subclasses, testSpeciesIsDefault)");
 
+subclasses.forEach(function(constructor) { constructor[Symbol.species] = () => new DataView(new ArrayBuffer()); });
+function testSpeciesReturnsDataView(array, constructor) {
+    try {
+        array.subarray(0, 0);
+    } catch (e) {
+        return e instanceof TypeError;
+    }
+    return false;
+}
+shouldBeTrue("forEachTypedArray(subclasses, testSpeciesReturnsDataView)");
+
 subclasses = typedArrays.map(function(constructor) { return class extends constructor { } } );
 function testSpeciesRemoveConstructor(array, constructor) {

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-26  Keith Miller  <keith_miller@apple.com>
+
+        speciesConstruct needs to throw if the result is a DataView
+        https://bugs.webkit.org/show_bug.cgi?id=199231
+
+        Reviewed by Mark Lam.
+
+        Previously, we only checked that the result was a
+        JSArrayBufferView, which can include DataViews. This is incorrect
+        as the result should be only be a TypedArray.
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+
 2019-06-26  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

@@ -71 +71 @@
 
     if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(vm, result)) {
+        if (view->type() == DataViewType) {
+            throwTypeError(exec, scope, "species constructor did not return a TypedArray View"_s);
+            return nullptr;
+        }
+
         if (!view->isNeutered())
             return view;