Title: [259444] trunk
Revision
259444
Author
shvaikal...@gmail.com
Date
2020-04-02 22:57:17 -0700 (Thu, 02 Apr 2020)

Log Message

TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
https://bugs.webkit.org/show_bug.cgi?id=188875

Reviewed by Ross Kirsling.

JSTests:

* stress/typedarray-configure-index.js:
* test262/expectations.yaml: Mark 10 test cases as passing.

Source/_javascript_Core:

This change implements steps 3.b.iv-v of TypedArray's [[DefineOwnProperty]] method [1],
preventing type errors from being thrown if descriptor lacks [[Enumerable]] or [[Writable]]
field and aligning JSC with V8 and SpiderMonkey.

[1]: https://tc39.es/ecma262/#sec-integer-indexed-exotic-objects-defineownproperty-p-desc

* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):

Modified Paths

Diff

Modified: trunk/JSTests/ChangeLog (259443 => 259444)


--- trunk/JSTests/ChangeLog	2020-04-03 05:46:16 UTC (rev 259443)
+++ trunk/JSTests/ChangeLog	2020-04-03 05:57:17 UTC (rev 259444)
@@ -1,3 +1,13 @@
+2020-04-02  Alexey Shvayka  <shvaikal...@gmail.com>
+
+        TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
+        https://bugs.webkit.org/show_bug.cgi?id=188875
+
+        Reviewed by Ross Kirsling.
+
+        * stress/typedarray-configure-index.js:
+        * test262/expectations.yaml: Mark 10 test cases as passing.
+
 2020-04-01  Ross Kirsling  <ross.kirsl...@sony.com>
 
         Intl.NumberFormat.prototype.format must preserve sign of -0

Modified: trunk/JSTests/stress/typedarray-configure-index.js (259443 => 259444)


--- trunk/JSTests/stress/typedarray-configure-index.js	2020-04-03 05:46:16 UTC (rev 259443)
+++ trunk/JSTests/stress/typedarray-configure-index.js	2020-04-03 05:57:17 UTC (rev 259444)
@@ -42,9 +42,9 @@
         let a = new constructor(10);
         Object.defineProperty(a, 0, makeDescriptor(false, false, true, true));
         assert(a[0] === 1);
-        assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, true, false), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
-        assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, false), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
-        assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, true), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
+        assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, true, false), "TypeError: Attempting to store non-enumerable indexed property on a typed array."));
+        assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, false), "TypeError: Attempting to store non-enumerable indexed property on a typed array."));
+        assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, true), "TypeError: Attempting to store non-writable indexed property on a typed array."));
 
         test(a, false, true, "TypeError: Attempting to configure non-configurable property.");
         for (c of bools) {

Modified: trunk/JSTests/test262/expectations.yaml (259443 => 259444)


--- trunk/JSTests/test262/expectations.yaml	2020-04-03 05:46:16 UTC (rev 259443)
+++ trunk/JSTests/test262/expectations.yaml	2020-04-03 05:57:17 UTC (rev 259444)
@@ -1836,15 +1836,6 @@
 test/built-ins/TypedArrayConstructors/from/set-value-abrupt-completion.js:
   default: 'Test262Error: interrupted source iteration Expected SameValue(«1», «[object Object]») to be true (Testing with Float64Array.)'
   strict mode: 'Test262Error: interrupted source iteration Expected SameValue(«1», «[object Object]») to be true (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/conversion-operation-consistent-nan.js:
-  default: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float32Array.)'
-  strict mode: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float32Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/conversion-operation.js:
-  default: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float64Array.)'
-  strict mode: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/desc-value-throws.js:
-  default: 'Test262Error: Expected a Test262Error but got a TypeError (Testing with Float64Array.)'
-  strict mode: 'Test262Error: Expected a Test262Error but got a TypeError (Testing with Float64Array.)'
 test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-realm.js:
   default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
   strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
@@ -1851,12 +1842,6 @@
 test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer.js:
   default: 'Test262Error: Throws TypeError on valid numeric index if instance has a detached buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
   strict mode: 'Test262Error: Throws TypeError on valid numeric index if instance has a detached buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/set-value.js:
-  default: 'Test262Error: set value for sample[0] returns true Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
-  strict mode: 'Test262Error: set value for sample[0] returns true Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/tonumber-value-detached-buffer.js:
-  default: 'Test262Error: detaching a ArrayBuffer during defining an element of a typed array viewing it should throw Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-  strict mode: 'Test262Error: detaching a ArrayBuffer during defining an element of a typed array viewing it should throw Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
 test/built-ins/TypedArrayConstructors/internals/Get/key-is-not-integer.js:
   default: 'Test262Error: OrdinaryGet was called! Ref: 9.1.8.1 3.c (Testing with Float64Array.)'
   strict mode: 'Test262Error: OrdinaryGet was called! Ref: 9.1.8.1 3.c (Testing with Float64Array.)'

Modified: trunk/Source/_javascript_Core/ChangeLog (259443 => 259444)


--- trunk/Source/_javascript_Core/ChangeLog	2020-04-03 05:46:16 UTC (rev 259443)
+++ trunk/Source/_javascript_Core/ChangeLog	2020-04-03 05:57:17 UTC (rev 259444)
@@ -1,3 +1,19 @@
+2020-04-02  Alexey Shvayka  <shvaikal...@gmail.com>
+
+        TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
+        https://bugs.webkit.org/show_bug.cgi?id=188875
+
+        Reviewed by Ross Kirsling.
+
+        This change implements steps 3.b.iv-v of TypedArray's [[DefineOwnProperty]] method [1],
+        preventing type errors from being thrown if descriptor lacks [[Enumerable]] or [[Writable]]
+        field and aligning JSC with V8 and SpiderMonkey.
+
+        [1]: https://tc39.es/ecma262/#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+
 2020-04-02  Commit Queue  <commit-qu...@webkit.org>
 
         Unreviewed, reverting r259390.

Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewInlines.h (259443 => 259444)


--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewInlines.h	2020-04-03 05:46:16 UTC (rev 259443)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewInlines.h	2020-04-03 05:57:17 UTC (rev 259444)
@@ -421,9 +421,12 @@
         if (descriptor.configurable())
             return throwTypeErrorIfNeeded("Attempting to configure non-configurable property on a typed array at index: ");
 
-        if (!descriptor.enumerable() || !descriptor.writable())
-            return throwTypeErrorIfNeeded("Attempting to store non-enumerable or non-writable property on a typed array at index: ");
+        if (descriptor.enumerablePresent() && !descriptor.enumerable())
+            return throwTypeErrorIfNeeded("Attempting to store non-enumerable property on a typed array at index: ");
 
+        if (descriptor.writablePresent() && !descriptor.writable())
+            return throwTypeErrorIfNeeded("Attempting to store non-writable property on a typed array at index: ");
+
         if (descriptor.value())
             RELEASE_AND_RETURN(scope, thisObject->putByIndex(thisObject, globalObject, index.value(), descriptor.value(), shouldThrow));
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to