ArrayPrototype methods should use JSValue::toLength for non-Arrays.
authorkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 17 Jun 2017 10:52:34 +0000 (10:52 +0000)
committerkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 17 Jun 2017 10:52:34 +0000 (10:52 +0000)
commit8724ec25104613da94633940da992baf8c3c24b0
tree4c905fe29ae4f741036a08f9ef2cc18711bd11f5
parent9371fca81af2c8ab1c7d5d68be9147cdfc042774
ArrayPrototype methods should use JSValue::toLength for non-Arrays.
https://bugs.webkit.org/show_bug.cgi?id=173506

JSTests:

Reviewed by Ryosuke Niwa.

Re-baseline tests.

* ChakraCore/test/Function/apply3.baseline-jsc:
* test262.yaml:

Source/JavaScriptCore:

Reviewed by Ryosuke Niwa.

This patch changes the result of unshift if old length +
unshift.arguments.length > (2 ** 53) - 1 to be a type error. Also,
the getLength function, which was always incorrect to use, has
been removed. Additionally, some cases where we were using a
constant for (2 ** 53) - 1 have been replaced with
maxSafeInteger()

* interpreter/Interpreter.cpp:
(JSC::sizeOfVarargs):
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncToLocaleString):
(JSC::arrayProtoFuncPop):
(JSC::arrayProtoFuncPush):
(JSC::arrayProtoFuncReverse):
(JSC::arrayProtoFuncShift):
(JSC::arrayProtoFuncSlice):
(JSC::arrayProtoFuncSplice):
(JSC::arrayProtoFuncUnShift):
(JSC::arrayProtoFuncIndexOf):
(JSC::arrayProtoFuncLastIndexOf):
* runtime/JSArrayInlines.h:
(JSC::getLength): Deleted.
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toLength):
* runtime/NumberConstructor.cpp:
(JSC::numberConstructorFuncIsSafeInteger):

LayoutTests:

Unreviewed test gardening.

* TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@218449 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChakraCore/test/Function/apply3.baseline-jsc
JSTests/ChangeLog
JSTests/test262.yaml
LayoutTests/ChangeLog
LayoutTests/TestExpectations
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/interpreter/Interpreter.cpp
Source/JavaScriptCore/runtime/ArrayPrototype.cpp
Source/JavaScriptCore/runtime/JSArrayInlines.h
Source/JavaScriptCore/runtime/JSCJSValue.cpp
Source/JavaScriptCore/runtime/NumberConstructor.cpp