Define length on CoW array should properly convert to writable
authorkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 24 May 2018 00:47:35 +0000 (00:47 +0000)
committerkeith_miller@apple.com <keith_miller@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 24 May 2018 00:47:35 +0000 (00:47 +0000)
https://bugs.webkit.org/show_bug.cgi?id=185927

Reviewed by Yusuke Suzuki.

JSTests:

* stress/cow-define-length-as-value.js: Added.
(test):

Source/JavaScriptCore:

* runtime/JSArray.cpp:
(JSC::JSArray::setLength):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232138 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/cow-define-length-as-value.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSArray.cpp

index 784e3df..6457934 100644 (file)
@@ -1,3 +1,13 @@
+2018-05-23  Keith Miller  <keith_miller@apple.com>
+
+        Define length on CoW array should properly convert to writable
+        https://bugs.webkit.org/show_bug.cgi?id=185927
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/cow-define-length-as-value.js: Added.
+        (test):
+
 2018-05-23  Michael Saboff  <msaboff@apple.com>
 
         Date.parse() doesn't properly handle input outside of ES Spec limits
diff --git a/JSTests/stress/cow-define-length-as-value.js b/JSTests/stress/cow-define-length-as-value.js
new file mode 100644 (file)
index 0000000..0de9fcd
--- /dev/null
@@ -0,0 +1,19 @@
+function test(create) {
+    // Set length to be smaller.
+    Object.defineProperty(create(), "length", { value: 1 });
+
+    // Set length to be bigger.
+    Object.defineProperty(create(), "length", { value: 4 });
+
+    // Set length to be the same size
+    Object.defineProperty(create(), "length", { value: 3 });
+}
+
+// Test Int32.
+test(() => [1, 2]);
+// Test double
+test(() => [1.123, 2.50934]);
+// Test contiguous via NaN
+test(() => [NaN, 2.50934]);
+// Test contiguous via string
+test(() => ["test", "42"]);
index 217fdeb..28a319a 100644 (file)
@@ -1,5 +1,15 @@
 2018-05-23  Keith Miller  <keith_miller@apple.com>
 
+        Define length on CoW array should properly convert to writable
+        https://bugs.webkit.org/show_bug.cgi?id=185927
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+
+2018-05-23  Keith Miller  <keith_miller@apple.com>
+
         InPlaceAbstractState should filter variables at the tail from a GetLocal by their flush format
         https://bugs.webkit.org/show_bug.cgi?id=185923
 
index ba1819f..a52ceca 100644 (file)
@@ -568,7 +568,7 @@ bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     Butterfly* butterfly = this->butterfly();
-    switch (indexingType()) {
+    switch (indexingMode()) {
     case ArrayClass:
         if (!newLength)
             return true;
@@ -581,6 +581,15 @@ bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException
         createInitialUndecided(vm, newLength);
         return true;
 
+    case CopyOnWriteArrayWithInt32:
+    case CopyOnWriteArrayWithDouble:
+    case CopyOnWriteArrayWithContiguous:
+        if (newLength == butterfly->publicLength())
+            return true;
+        convertFromCopyOnWrite(vm);
+        butterfly = this->butterfly();
+        FALLTHROUGH;
+
     case ArrayWithUndecided:
     case ArrayWithInt32:
     case ArrayWithDouble: