Attachment 346816 Details for Bug 188430 – Patch

[patch] Patch

bug-188430-20180808204734.patch (text/plain), 3.43 KB, created by Keith Miller on 2018-08-08 20:47:34 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2018-08-08 20:47:34 PDT

Size: 3.43 KB

patch

obsolete

>Subversion Revision: 234716
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 47b02f0dd262a61a33e8fee9fe3bdd2f63c59368..ea394bb72eface4c73be1102bbd7f521084b6457 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,13 @@
>+2018-08-08  Keith Miller  <keith_miller@apple.com>
>+
>+        Array.prototype.sort should call @toLength instead of ">>> 0"
>+        https://bugs.webkit.org/show_bug.cgi?id=188430
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * builtins/ArrayPrototype.js:
>+        (sort):
>+
> 2018-08-08  Keith Miller  <keith_miller@apple.com>
> 
>         Array.prototype.sort should throw TypeError if param is a not callable object
>diff --git a/Source/JavaScriptCore/builtins/ArrayPrototype.js b/Source/JavaScriptCore/builtins/ArrayPrototype.js
>index a8796540b43b98c8035a4cc67239e4885bd12618..95a3902d4a1942a053928e3608f0adfc066230e1 100644
>--- a/Source/JavaScriptCore/builtins/ArrayPrototype.js
>+++ b/Source/JavaScriptCore/builtins/ArrayPrototype.js
>@@ -603,7 +603,7 @@ function sort(comparator)
> 
>     let array = @toObject(this, "Array.prototype.sort requires that |this| not be null or undefined");
> 
>-    let length = array.length >>> 0;
>+    let length =  @toLength(array.length);
> 
>     // For compatibility with Firefox and Chrome, do nothing observable
>     // to the target array if it has 0 or 1 sortable properties.
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 9b3e59c7580922f8df21b23bfb12aab1b6d3da7a..01b39fac73e67fd3670681b3d4112f6f51f12262 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,12 @@
>+2018-08-08  Keith Miller  <keith_miller@apple.com>
>+
>+        Array.prototype.sort should call @toLength instead of ">>> 0"
>+        https://bugs.webkit.org/show_bug.cgi?id=188430
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * test262/expectations.yaml:
>+
> 2018-08-08  Keith Miller  <keith_miller@apple.com>
> 
>         Array.prototype.sort should throw TypeError if param is a not callable object
>diff --git a/JSTests/test262/expectations.yaml b/JSTests/test262/expectations.yaml
>index 6b8a120a91feec7be405b3e678cef3d9767ed791..3fe3d5cf2f335ecf303d297254ced2253a548477 100644
>--- a/JSTests/test262/expectations.yaml
>+++ b/JSTests/test262/expectations.yaml
>@@ -669,9 +669,6 @@ test/built-ins/Array/prototype/slice/length-exceeding-integer-limit.js:
> test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js:
>   default: 'TypeError: Attempted to assign to readonly property.'
>   strict mode: 'TypeError: Attempted to assign to readonly property.'
>-test/built-ins/Array/prototype/sort/S15.4.4.11_A4_T3.js:
>-  default: 'Test262Error: #3: var obj = {}; obj.sort = Array.prototype.sort; obj[0] = "z"; obj[1] = "y"; obj[2] = "x"; obj.length = -4294967294; obj.sort(); obj[0] === "z". Actual: y'
>-  strict mode: 'Test262Error: #3: var obj = {}; obj.sort = Array.prototype.sort; obj[0] = "z"; obj[1] = "y"; obj[2] = "x"; obj.length = -4294967294; obj.sort(); obj[0] === "z". Actual: y'
> test/built-ins/Array/prototype/splice/S15.4.4.12_A3_T1.js:
>   default: 'Test262Error: #1: var obj = {}; obj.splice = Array.prototype.splice; obj[0] = "x"; obj[4294967295] = "y"; obj.length = 4294967296; var arr = obj.splice(4294967295,1); arr.length === 1. Actual: 0'
>   strict mode: 'Test262Error: #1: var obj = {}; obj.splice = Array.prototype.splice; obj[0] = "x"; obj[4294967295] = "y"; obj.length = 4294967296; var arr = obj.splice(4294967295,1); arr.length === 1. Actual: 0'

Actions: View | Formatted Diff | Diff

Attachments on bug 188430: 346816 | 346819 | 346821 | 346822 | 346823 | 346824 | 346825 | 346827 | 346828 | 346829 | 346842