ArrayBuffer constructor needs to create subclass structures before its buffer

https://bugs.webkit.org/show_bug.cgi?id=173510

Reviewed by Yusuke Suzuki.

JSTests:

* test262.yaml:

Source/JavaScriptCore:

* runtime/JSArrayBufferConstructor.cpp:
(JSC::constructArrayBuffer):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@218452 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 3c0b153..627cbfe 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,5 +1,14 @@
 2017-06-17  Keith Miller  <keith_miller@apple.com>
 
+        ArrayBuffer constructor needs to create subclass structures before its buffer
+        https://bugs.webkit.org/show_bug.cgi?id=173510
+
+        Reviewed by Yusuke Suzuki.
+
+        * test262.yaml:
+
+2017-06-17  Keith Miller  <keith_miller@apple.com>
+
         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
         https://bugs.webkit.org/show_bug.cgi?id=173506
 

diff --git a/JSTests/test262.yaml b/JSTests/test262.yaml
index 68aea73..e73ab63 100644 (file)
--- a/JSTests/test262.yaml
+++ b/JSTests/test262.yaml
@@ -12890,9 +12890,9 @@
 - path: test262/test/built-ins/ArrayBuffer/allocation-limit.js
   cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], [:strict]
 - path: test262/test/built-ins/ArrayBuffer/data-allocation-after-object-creation.js
-  cmd: runTest262 :fail, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], []
+  cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], []
 - path: test262/test/built-ins/ArrayBuffer/data-allocation-after-object-creation.js
-  cmd: runTest262 :fail, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], [:strict]
+  cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], [:strict]
 - path: test262/test/built-ins/ArrayBuffer/init-zero.js
   cmd: runTest262 :normal, "NoException", ["../../../harness/assert.js", "../../../harness/sta.js"], []
 - path: test262/test/built-ins/ArrayBuffer/init-zero.js

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 6da80fc..20768e2 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,15 @@
 2017-06-17  Keith Miller  <keith_miller@apple.com>
 
+        ArrayBuffer constructor needs to create subclass structures before its buffer
+        https://bugs.webkit.org/show_bug.cgi?id=173510
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+
+2017-06-17  Keith Miller  <keith_miller@apple.com>
+
         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
         https://bugs.webkit.org/show_bug.cgi?id=173506
 

diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp b/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
index a09c07f..9664923 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
@@ -87,7 +87,10 @@ static EncodedJSValue JSC_HOST_CALL constructArrayBuffer(ExecState* exec)
 
     JSArrayBufferConstructor* constructor =
         jsCast<JSArrayBufferConstructor*>(exec->jsCallee());
-    
+
+    Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), constructor->globalObject()->arrayBufferStructure(constructor->sharingMode()));
+    RETURN_IF_EXCEPTION(scope, { });
+
     unsigned length;
     if (exec->argumentCount()) {
         length = exec->uncheckedArgument(0).toIndex(exec, "length");
@@ -98,20 +101,16 @@ static EncodedJSValue JSC_HOST_CALL constructArrayBuffer(ExecState* exec)
         // with a zero length.
         length = 0;
     }
-    
+
     auto buffer = ArrayBuffer::tryCreate(length, 1);
     if (!buffer)
         return JSValue::encode(throwOutOfMemoryError(exec, scope));
     
     if (constructor->sharingMode() == ArrayBufferSharingMode::Shared)
         buffer->makeShared();
-    
     ASSERT(constructor->sharingMode() == buffer->sharingMode());
-    
-    Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), constructor->globalObject()->arrayBufferStructure(constructor->sharingMode()));
-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
     JSArrayBuffer* result = JSArrayBuffer::create(vm, arrayBufferStructure, WTFMove(buffer));
-    
     return JSValue::encode(result);
 }