AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[builtins] Allow TypedArray constructor to accept big negative numbers.

Browse Source 
Previously we enforced that all lengths for ArrayLike objects must
be within Smi range, but all negative numbers should actually be first
converted to +0.

Bug: chromium:740372
Change-Id: If50de9ce0eeb7cb09e14b8e8803f434350d00508
Reviewed-on: https://chromium-review.googlesource.com/566867
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46615}
This commit is contained in:
Peter Marshall 2017-07-12 17:45:44 +02:00 committed by Commit Bot
parent de3a85d1c1
commit d11da5891f
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/code-stub-assembler.cc
View File

@ -4826,9 +4826,11 @@ Node* CodeStubAssembler::ToSmiLength(Node* input, Node* const context,
BIND(&to_integer);
result.Bind(ToInteger(context, result.value(),
CodeStubAssembler::kTruncateMinusZero));
GotoIfNot(TaggedIsSmi(result.value()), range_error);
CSA_ASSERT(this, TaggedIsSmi(result.value()));
Goto(&negative_check);
GotoIf(TaggedIsSmi(result.value()), &negative_check);
// result.value() can still be a negative HeapNumber here.
Branch(IsTrue(CallBuiltin(Builtins::kLessThan, context, result.value(),
SmiConstant(0))),
&return_zero, range_error);
BIND(&negative_check);
Branch(SmiLessThan(result.value(), SmiConstant(0)), &return_zero, &done);

6
test/mjsunit/es6/typedarray-construct-by-array-like.js
View File

@ -196,6 +196,12 @@ tests.push(function TestOffsetIsUsed(constr) {
TestOffsetIsUsedRunner(constr, 128);
});
tests.push(function TestLengthIsNonSmiNegativeNumber(constr) {
var ta = new constr({length: -%_MaxSmi() - 2});
assertEquals(0, ta.length);
});
// Helpers for above tests.
function TestOffsetIsUsedRunner(constr, n) {