AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[SAB] Fix {newtarget-prototype-is-not-object,proto-from-ctor-realm} tests

Browse Source 
This revealed a bug in the TypedArray(typedArray) constructor when the arg is backed by a SharedArrayBuffer.

Also install the species getter and add a test, since it's not tested in
test262 presently.

BUG=v8:5983,v8:5984
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2798403004
Cr-Commit-Position: refs/heads/master@{#44500}
This commit is contained in:
binji 2017-04-08 13:13:45 -07:00 committed by Commit bot
parent 4faa4952fd
commit 03e260cb2a
5 changed files with 23 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/bootstrapper.cc
View File

@ -3901,7 +3901,9 @@ void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
Builtins::kSharedArrayBufferPrototypeGetByteLength,
BuiltinFunctionId::kSharedArrayBufferByteLength,
Builtins::kSharedArrayBufferPrototypeSlice);
native_context()->set_shared_array_buffer_fun(*shared_array_buffer_fun);
InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
InstallSpeciesGetter(shared_array_buffer_fun);
Handle<String> name = factory->InternalizeUtf8String("Atomics");
Handle<JSFunction> cons = factory->NewFunction(name);

7
src/js/typedarray.js
View File

@ -147,7 +147,12 @@ function NAMEConstructByTypedArray(obj, typedArray) {
var byteLength = %_ArrayBufferViewGetByteLength(typedArray);
var newByteLength = length * ELEMENT_SIZE;
%typed_array_construct_by_array_like(obj, typedArray, length, ELEMENT_SIZE);
var bufferConstructor = SpeciesConstructor(srcData, GlobalArrayBuffer);
// The spec requires that constructing a typed array using a SAB-backed typed
// array use the ArrayBuffer constructor, not the species constructor. See
// https://tc39.github.io/ecma262/#sec-typedarray-typedarray.
var bufferConstructor = IS_SHAREDARRAYBUFFER(srcData)
? GlobalArrayBuffer
: SpeciesConstructor(srcData, GlobalArrayBuffer);
var prototype = bufferConstructor.prototype;
// TODO(littledan): Use the right prototype based on bufferConstructor's realm
if (IS_RECEIVER(prototype) && prototype !== GlobalArrayBufferPrototype) {

10
test/mjsunit/harmony/sharedarraybuffer.js
View File

@ -583,3 +583,13 @@ desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype,
var a = new ArrayBuffer(10);
Object.defineProperty(a, 'byteLength', desc);
assertThrows(function() {a.byteLength}, TypeError);
// test SharedArrayBuffer species getter
assertSame(SharedArrayBuffer[Symbol.species], SharedArrayBuffer);
var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer, Symbol.species);
assertEquals("function", typeof desc.get);
assertEquals("get [Symbol.species]", desc.get.name);
assertEquals(0, desc.get.length);
assertEquals("undefined", typeof desc.set);
assertTrue(desc.configurable);
assertFalse(desc.enumerable);

4
test/mjsunit/mjsunit.status
View File

@ -358,6 +358,10 @@
'big-object-literal': [SKIP],
'regress/regress-crbug-178790': [SKIP],
# https://bugs.chromium.org/p/v8/issues/detail?id=4639
# The failed allocation causes an asan/msan/tsan error
'es6/typedarray-construct-offset-not-smi': [SKIP],
# Exception thrown during bootstrapping on ASAN builds, see issue 4236.
'regress/regress-1132': [SKIP],
}], # 'asan == True'

6
test/test262/test262.status
View File

@ -538,12 +538,6 @@
'built-ins/Atomics/wake/good-views': ['--harmony-sharedarraybuffer', FAIL],
'built-ins/Atomics/xor/good-views': ['--harmony-sharedarraybuffer', FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=5983
'built-ins/SharedArrayBuffer/newtarget-prototype-is-not-object': [FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=5984
'built-ins/SharedArrayBuffer/proto-from-ctor-realm': [FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=6045
'intl402/NumberFormat/prototype/format/11.3.2_TRF': [FAIL],
'intl402/NumberFormat/prototype/format/11.3.2_TRP': [FAIL],