163417 2016-10-13 16:13:59 -0700 Array methods are incorrect with objects whose "length" exceeds 2 ** 32 - 1 2020-05-20 14:14:46 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED DUPLICATE 211205 https://bugs.webkit.org/show_bug.cgi?id=212167 P2 Minor --- 209449 1 mark.lam ashvayka 958268052 ashvayka ews-watchlist fpizlo ggaren isol2 jfbastien joepeck keith_miller leo msaboff ross.kirsling saam tzagallo yaohouyou ysuzuki oldest_to_newest 1239999 0 mark.lam 2016-10-13 16:13:59 -0700 Step 8 of the Array.prototype.splice spec (https://tc39.github.io/ecma262/#sec-array.prototype.splice) states that we should throw a TypeError if the spliced array's length will exceed 2^53-1. This is gated on the JSArray getLength() convenience function being updated to return a length value that is greater than 32-bits. This issue is only a compliance issue in a contrived example, e.g. var maxLength = (2 ** 53) - 1; Array.prototype.splice.call({ length: maxLength }, maxLength, 0, 1, 2, 3); In real world code, the JSC runtime prevents us from creating arrays with a length that exceeds UINT_MAX. We're also bounded on the number of args that we pass to Array.prototype.splice. As a result, we can never splice together an array that gets anywhere near 2^53-1. We'll get an OutOfMemoryError long before then. 1240003 1 291531 mark.lam 2016-10-13 16:20:40 -0700 Created attachment 291531 archiving test case for step 8 of the spec. 1633349 2 ashvayka 2020-03-24 09:35:06 -0700 Apart from Array.prototype.splice, other Array methods (mostly ones that are implemented in C++) are affected. https://github.com/tc39/test262/pull/2509 completes test coverage for those, allowing them to be fixed with a single patch. 1633355 3 ashvayka 2020-03-24 09:40:32 -0700 *** Bug 208639 has been marked as a duplicate of this bug. *** 1633358 4 ashvayka 2020-03-24 09:42:09 -0700 *** Bug 187777 has been marked as a duplicate of this bug. *** 1637375 5 395381 ashvayka 2020-04-03 08:58:49 -0700 Created attachment 395381 WIP Patch WIP 1637383 6 ashvayka 2020-04-03 09:23:09 -0700 The following Array.prototype.* methods are affected: indexOf (slow path) lastIndexOf (slow path) pop (slow path) push reverse (slow path) slice (slow path) splice unshift Given that fast paths are affected, we can't just wrap indices in Identifier::from(). Instead, we need to add support for indices > MAX_ARRAY_INDEX in: get hasProperty putDirectIndex deletePropertyByIndex (apart from few ArrayPrototype.cpp helpers) 1. Should we create new overloads like we already have for get(): ALWAYS_INLINE JSValue JSValue::get(JSGlobalObject* globalObject, uint64_t propertyName) const or promote `unsigned` parameter types of existing declarations? 2. Should we use `double` (toLength() return value, Identifier::from() argument type) or `uint64_t` (argument type of speciesConstructArray() and slowJoin())? 1637397 7 ashvayka 2020-04-03 09:46:29 -0700 *** Bug 185625 has been marked as a duplicate of this bug. *** 1643145 8 ashvayka 2020-04-18 19:59:24 -0700 *** Bug 199663 has been marked as a duplicate of this bug. *** 1647588 9 ashvayka 2020-04-30 15:23:50 -0700 *** This bug has been marked as a duplicate of bug 211205 *** 291531 2016-10-13 16:20:40 -0700 2016-10-13 16:20:40 -0700 archiving test case for step 8 of the spec. array-splice-on-array-with-max-length.js application/x-javascript 769 mark.lam Ly9AIHJ1bkZUTE5vQ0pJVAoKZnVuY3Rpb24gc2hvdWxkRXF1YWwoYWN0dWFsLCBleHBlY3RlZCkg ewogICAgaWYgKGFjdHVhbCAhPSBleHBlY3RlZCkgewogICAgICAgIHRocm93ICJFUlJPUjogZXhw ZWN0ICIgKyBleHBlY3RlZCArICIsIGFjdHVhbCAiICsgYWN0dWFsOwogICAgfQp9CgpsZXQgbnVt SXRlcmF0aW9ucyA9IDEwMDAwOwoKZnVuY3Rpb24gdGVzdCgpIHsKICAgIC8vIFNlZSBodHRwczov L3RjMzkuZ2l0aHViLmlvL2VjbWEyNjIvI3NlYy1hcnJheS5wcm90b3R5cGUuc3BsaWNlLCBzdGVw IDguCiAgICB2YXIgbWF4TGVuZ3RoID0gKDIgKiogNTMpIC0gMTsKICAgIEFycmF5LnByb3RvdHlw ZS5zcGxpY2UuY2FsbCh7IGxlbmd0aDogbWF4TGVuZ3RoIH0sIG1heExlbmd0aCwgMCwgMSwgMiwg Myk7Cn0Kbm9JbmxpbmUodGVzdCk7CgpmdW5jdGlvbiBydW5UZXN0KCkgewogICAgCiAgICBmb3Ig KHZhciBpID0gMDsgaSA8IG51bUl0ZXJhdGlvbnM7IGkrKykgewogICAgICAgIHZhciBleGNlcHRp b24gPSB1bmRlZmluZWQ7CiAgICAgICAgdHJ5IHsKICAgICAgICAgICAgdGVzdCgpOwogICAgICAg IH0gY2F0Y2ggKGUpIHsKICAgICAgICAgICAgZXhjZXB0aW9uID0gIiIgKyBlOwogICAgICAgICAg ICBleGNlcHRpb24gPSBleGNlcHRpb24uc3Vic3RyKDAsIDEwKTsgLy8gU2VhcmNoIGZvciAiVHlw ZUVycm9yOiIuCiAgICAgICAgfQogICAgICAgIHNob3VsZEVxdWFsKGV4Y2VwdGlvbiwgIlR5cGVF cnJvcjoiKTsKICAgIH0KfQpydW5UZXN0KCk7Cg== 395381 2020-04-03 08:58:49 -0700 2020-05-20 14:14:30 -0700 WIP Patch bug-163417-20200403185847.patch text/plain 5244 ashvayka U3VidmVyc2lvbiBSZXZpc2lvbjogMjU5MzYzCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBm MjE5ZWI2OGJjMjQ4MzZiY2I1M2JjMGRjM2NiZDA2ZmZkMjM2OGUzLi5iN2U3ZDQ4ZWZjMzY0YWQ0 MGI2NTdiYzNkYWY1OGMzYTM5Y2ZmMWUzIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNSBAQAorMjAyMC0wNC0wMyAgQWxleGV5IFNodmF5a2EgIDxzaHZhaWthbGVzaEBnbWFp bC5jb20+CisKKyAgICAgICAgQXJyYXkgbWV0aG9kcyBhcmUgaW5jb3JyZWN0IHdpdGggb2JqZWN0 cyB3aG9zZSAibGVuZ3RoIiBleGNlZWRzIDIgKiogMzIgLSAxCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjM0MTcKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGJ1aWx0aW5zL0FycmF5Q29uc3RydWN0b3Iu anM6CisgICAgICAgIChmcm9tKToKKyAgICAgICAgKiBidWlsdGlucy9BcnJheVByb3RvdHlwZS5q czoKKyAgICAgICAgKGdsb2JhbFByaXZhdGUuY29uY2F0U2xvd1BhdGgpOgorCiAyMDIwLTA0LTAx ICBKdXN0aW4gTWljaGF1ZCAgPGp1c3RpbkBqdXN0aW5taWNoYXVkLmNvbT4KIAogICAgICAgICBE ZWxldGUgSUMgaW5jb3JyZWN0bHkgY2FjaGVzIGZvciBwcm94aWVzCmRpZmYgLS1naXQgYS9Tb3Vy Y2UvSmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvQXJyYXlDb25zdHJ1Y3Rvci5qcyBiL1NvdXJjZS9K YXZhU2NyaXB0Q29yZS9idWlsdGlucy9BcnJheUNvbnN0cnVjdG9yLmpzCmluZGV4IDg4NzdlYmY5 YTMwNTgwZmNhNjQ0NTM1MDM5ZmYyZTU1YTYyYzM4NjUuLjNhODc4MWE5YzZhMDVmNjNhNGFjNWUx M2Y0Zjg4ODA2Yjg4OTE1NTEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWls dGlucy9BcnJheUNvbnN0cnVjdG9yLmpzCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWls dGlucy9BcnJheUNvbnN0cnVjdG9yLmpzCkBAIC03MSw2ICs3MSw4IEBAIGZ1bmN0aW9uIGZyb20o aXRlbXMgLyosIG1hcEZuLCB0aGlzQXJnICovKQogICAgICAgICB3cmFwcGVyLkBAaXRlcmF0b3Ig PSBmdW5jdGlvbigpIHsgcmV0dXJuIGl0ZXJhdG9yOyB9OwogCiAgICAgICAgIGZvciAodmFyIHZh bHVlIG9mIHdyYXBwZXIpIHsKKyAgICAgICAgICAgIGlmIChrID49IEBNQVhfU0FGRV9JTlRFR0VS KQorICAgICAgICAgICAgICAgIEB0aHJvd1R5cGVFcnJvcigiTGVuZ3RoIGV4Y2VlZGVkIHRoZSBt YXhpbXVtIGFycmF5IGxlbmd0aCIpOwogICAgICAgICAgICAgaWYgKG1hcEZuKQogICAgICAgICAg ICAgICAgIEBwdXRCeVZhbERpcmVjdChyZXN1bHQsIGssIHRoaXNBcmcgPT09IEB1bmRlZmluZWQg PyBtYXBGbih2YWx1ZSwgaykgOiBtYXBGbi5AY2FsbCh0aGlzQXJnLCB2YWx1ZSwgaykpOwogICAg ICAgICAgICAgZWxzZQpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2J1aWx0aW5z L0FycmF5UHJvdG90eXBlLmpzIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2J1aWx0aW5zL0FycmF5 UHJvdG90eXBlLmpzCmluZGV4IDUwZDAwNTE5ODZkMTAyYTFiNzViYzY2YmE4NDY4ZDZlYjU4NTBj NzMuLjBhMzZiNGMzZDhlNDQ0MjZhNDUzYjdiZTUxNGJhZWM5ZjA1N2VjOWMgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWlsdGlucy9BcnJheVByb3RvdHlwZS5qcworKysgYi9T b3VyY2UvSmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvQXJyYXlQcm90b3R5cGUuanMKQEAgLTU1OCw5 ICs1NTgsOSBAQCBmdW5jdGlvbiBjb25jYXRTbG93UGF0aCgpCiAgICAgICAgIHZhciBzcHJlYWRh YmxlID0gQGlzT2JqZWN0KGN1cnJlbnRFbGVtZW50KSAmJiBjdXJyZW50RWxlbWVudC5AQGlzQ29u Y2F0U3ByZWFkYWJsZTsKICAgICAgICAgaWYgKChzcHJlYWRhYmxlID09PSBAdW5kZWZpbmVkICYm IEBpc0FycmF5KGN1cnJlbnRFbGVtZW50KSkgfHwgc3ByZWFkYWJsZSkgewogICAgICAgICAgICAg dmFyIGxlbmd0aCA9IEB0b0xlbmd0aChjdXJyZW50RWxlbWVudC5sZW5ndGgpOwotICAgICAgICAg ICAgaWYgKGxlbmd0aCArIHJlc3VsdEluZGV4ID4gQE1BWF9BUlJBWV9JTkRFWCkKLSAgICAgICAg ICAgICAgICBAdGhyb3dSYW5nZUVycm9yKCJMZW5ndGggZXhjZWVkZWQgdGhlIG1heGltdW0gYXJy YXkgbGVuZ3RoIik7Ci0gICAgICAgICAgICBpZiAocmVzdWx0SXNBcnJheSAmJiBAaXNKU0FycmF5 KGN1cnJlbnRFbGVtZW50KSkgeworICAgICAgICAgICAgaWYgKGxlbmd0aCArIHJlc3VsdEluZGV4 ID4gQE1BWF9TQUZFX0lOVEVHRVIpCisgICAgICAgICAgICAgICAgQHRocm93VHlwZUVycm9yKCJM ZW5ndGggZXhjZWVkZWQgdGhlIG1heGltdW0gYXJyYXkgbGVuZ3RoIik7CisgICAgICAgICAgICBp ZiAocmVzdWx0SXNBcnJheSAmJiBAaXNKU0FycmF5KGN1cnJlbnRFbGVtZW50KSAmJiBsZW5ndGgg KyByZXN1bHRJbmRleCA8PSBATUFYX0FSUkFZX0lOREVYKSB7CiAgICAgICAgICAgICAgICAgQGFw cGVuZE1lbWNweShyZXN1bHQsIGN1cnJlbnRFbGVtZW50LCByZXN1bHRJbmRleCk7CiAgICAgICAg ICAgICAgICAgcmVzdWx0SW5kZXggKz0gbGVuZ3RoOwogICAgICAgICAgICAgfSBlbHNlIHsKQEAg LTU3MSw4ICs1NzEsOCBAQCBmdW5jdGlvbiBjb25jYXRTbG93UGF0aCgpCiAgICAgICAgICAgICAg ICAgfQogICAgICAgICAgICAgfQogICAgICAgICB9IGVsc2UgewotICAgICAgICAgICAgaWYgKHJl c3VsdEluZGV4ID49IEBNQVhfQVJSQVlfSU5ERVgpCi0gICAgICAgICAgICAgICAgQHRocm93UmFu Z2VFcnJvcigiTGVuZ3RoIGV4Y2VlZGVkIHRoZSBtYXhpbXVtIGFycmF5IGxlbmd0aCIpOworICAg ICAgICAgICAgaWYgKHJlc3VsdEluZGV4ID49IEBNQVhfU0FGRV9JTlRFR0VSKQorICAgICAgICAg ICAgICAgIEB0aHJvd1R5cGVFcnJvcigiTGVuZ3RoIGV4Y2VlZGVkIHRoZSBtYXhpbXVtIGFycmF5 IGxlbmd0aCIpOwogICAgICAgICAgICAgQHB1dEJ5VmFsRGlyZWN0KHJlc3VsdCwgcmVzdWx0SW5k ZXgrKywgY3VycmVudEVsZW1lbnQpOwogICAgICAgICB9CiAgICAgICAgIGN1cnJlbnRFbGVtZW50 ID0gYXJndW1lbnRzW2FyZ0luZGV4XTsKZGlmZiAtLWdpdCBhL0pTVGVzdHMvQ2hhbmdlTG9nIGIv SlNUZXN0cy9DaGFuZ2VMb2cKaW5kZXggOWY5NGViMmM1YjZkMGI3MWJmZDE2Mjk5YzE1OGE2Njcx YjBmZWI0Ny4uN2Q3YWZhZGY2ZGQ1ODY3N2M4OTRiNzk0MGI4NmRjZGU5YTMzN2NmNCAxMDA2NDQK LS0tIGEvSlNUZXN0cy9DaGFuZ2VMb2cKKysrIGIvSlNUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyAr MSwxMiBAQAorMjAyMC0wNC0wMyAgQWxleGV5IFNodmF5a2EgIDxzaHZhaWthbGVzaEBnbWFpbC5j b20+CisKKyAgICAgICAgQXJyYXkgbWV0aG9kcyBhcmUgaW5jb3JyZWN0IHdpdGggb2JqZWN0cyB3 aG9zZSAibGVuZ3RoIiBleGNlZWRzIDIgKiogMzIgLSAxCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjM0MTcKKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIHRlc3QyNjIvZXhwZWN0YXRpb25zLnlhbWw6CisK IDIwMjAtMDQtMDEgIEp1c3RpbiBNaWNoYXVkICA8anVzdGluQGp1c3Rpbm1pY2hhdWQuY29tPgog CiAgICAgICAgIERlbGV0ZSBJQyBpbmNvcnJlY3RseSBjYWNoZXMgZm9yIHByb3hpZXMKZGlmZiAt LWdpdCBhL0pTVGVzdHMvdGVzdDI2Mi9leHBlY3RhdGlvbnMueWFtbCBiL0pTVGVzdHMvdGVzdDI2 Mi9leHBlY3RhdGlvbnMueWFtbAppbmRleCAxYzFiODA3ZWQzNDFjY2UyMzMwNjEyYjczZDg1N2M1 MWNlODdlNDY5Li4zOWQ4YWViNTQ4MDA1NmFiODliZWRlZmY3ZDhjYmNhZjkyMjI5NjdlIDEwMDY0 NAotLS0gYS9KU1Rlc3RzL3Rlc3QyNjIvZXhwZWN0YXRpb25zLnlhbWwKKysrIGIvSlNUZXN0cy90 ZXN0MjYyL2V4cGVjdGF0aW9ucy55YW1sCkBAIC02MjEsMTIgKzYyMSw2IEBAIHRlc3QvYnVpbHQt aW5zL0FycmF5L3Byb3RvLWZyb20tY3Rvci1yZWFsbS10d28uanM6CiB0ZXN0L2J1aWx0LWlucy9B cnJheS9wcm90by1mcm9tLWN0b3ItcmVhbG0temVyby5qczoKICAgZGVmYXVsdDogJ1Rlc3QyNjJF cnJvcjogbmV3VGFyZ2V0LnByb3RvdHlwZSBpcyB1bmRlZmluZWQgRXhwZWN0ZWQgU2FtZVZhbHVl KMKrwrssIMKrwrspIHRvIGJlIHRydWUnCiAgIHN0cmljdCBtb2RlOiAnVGVzdDI2MkVycm9yOiBu ZXdUYXJnZXQucHJvdG90eXBlIGlzIHVuZGVmaW5lZCBFeHBlY3RlZCBTYW1lVmFsdWUowqvCuywg wqvCuykgdG8gYmUgdHJ1ZScKLXRlc3QvYnVpbHQtaW5zL0FycmF5L3Byb3RvdHlwZS9jb25jYXQv YXJnLWxlbmd0aC1leGNlZWRpbmctaW50ZWdlci1saW1pdC5qczoKLSAgZGVmYXVsdDogJ1Rlc3Qy NjJFcnJvcjogRXhwZWN0ZWQgYSBUeXBlRXJyb3IgYnV0IGdvdCBhIFJhbmdlRXJyb3InCi0gIHN0 cmljdCBtb2RlOiAnVGVzdDI2MkVycm9yOiBFeHBlY3RlZCBhIFR5cGVFcnJvciBidXQgZ290IGEg UmFuZ2VFcnJvcicKLXRlc3QvYnVpbHQtaW5zL0FycmF5L3Byb3RvdHlwZS9jb25jYXQvYXJnLWxl bmd0aC1uZWFyLWludGVnZXItbGltaXQuanM6Ci0gIGRlZmF1bHQ6ICdUZXN0MjYyRXJyb3I6IEV4 cGVjdGVkIGEgVGVzdDI2MkVycm9yIGJ1dCBnb3QgYSBSYW5nZUVycm9yJwotICBzdHJpY3QgbW9k ZTogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0ZWQgYSBUZXN0MjYyRXJyb3IgYnV0IGdvdCBhIFJhbmdl RXJyb3InCiB0ZXN0L2J1aWx0LWlucy9BcnJheS9wcm90b3R5cGUvY29uY2F0L2lzLWNvbmNhdC1z cHJlYWRhYmxlLWdldC1vcmRlci5qczoKICAgZGVmYXVsdDogJ1Rlc3QyNjJFcnJvcjogRXhwZWN0 ZWQgW2lzQ29uY2F0U3ByZWFkYWJsZSwgY29uc3RydWN0b3IsIGlzQ29uY2F0U3ByZWFkYWJsZV0g YW5kIFtjb25zdHJ1Y3RvciwgaXNDb25jYXRTcHJlYWRhYmxlXSB0byBoYXZlIHRoZSBzYW1lIGNv bnRlbnRzLiAnCiAgIHN0cmljdCBtb2RlOiAnVGVzdDI2MkVycm9yOiBFeHBlY3RlZCBbaXNDb25j YXRTcHJlYWRhYmxlLCBjb25zdHJ1Y3RvciwgaXNDb25jYXRTcHJlYWRhYmxlXSBhbmQgW2NvbnN0 cnVjdG9yLCBpc0NvbmNhdFNwcmVhZGFibGVdIHRvIGhhdmUgdGhlIHNhbWUgY29udGVudHMuICcK