Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 78c68289ca4f8d0a213a5b3b52548847f6be37aa
https://github.com/WebKit/WebKit/commit/78c68289ca4f8d0a213a5b3b52548847f6be37aa
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-14 (Wed, 14 Oct 2026)
Changed paths:
A JSTests/stress/new-array-buffer-negative-length-error-message.js
A JSTests/stress/new-typed-array-with-unused-result-constant-length.js
A
JSTests/stress/new-typed-array-with-unused-result-throws-on-negative-length.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
Log Message:
-----------
[JSC] TypedArray / ArrayBuffer constructions throw range error for negative
length
https://bugs.webkit.org/show_bug.cgi?id=327491
rdar://189976051
Reviewed by Sosuke Suzuki and Tadeu Zagallo.
TypedArray / ArrayBuffer constructions throw range error for negative
length, thus,
1. They should start with MustGenerate.
2. When strength reduction found that input is legit constant integer,
we clear MustGenerate.
3. Also fix operation to throw a range error.
Tests: JSTests/stress/new-array-buffer-negative-length-error-message.js
JSTests/stress/new-typed-array-with-unused-result-constant-length.js
JSTests/stress/new-typed-array-with-unused-result-throws-on-negative-length.js
* JSTests/stress/new-array-buffer-negative-length-error-message.js: Added.
(shouldBe):
(errorFrom):
(newArrayBufferUnused):
(newArrayBuffer):
* JSTests/stress/new-typed-array-with-unused-result-constant-length.js: Added.
(shouldThrowRangeError):
(newUnusedWithConstantLength):
(newUint8ArrayWithNegativeConstant):
(newArrayBufferWithNegativeConstant):
*
JSTests/stress/new-typed-array-with-unused-result-throws-on-negative-length.js:
Added.
(shouldThrowRangeError):
(newUint8Array):
(newFloat64Array):
(newArrayBuffer):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
Canonical link: https://commits.webkit.org/323740@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
