6c585ef0e8
When storing an indexed property in a typed array, it's necessary to convert the value to a Number (or to a Bigint) before performing the bounds check, per https://tc39.github.io/ecma262/#sec-integerindexedelementset. This CL adds appropriate type conversions in Object::SetPropertyInternal (which technically is reached after the bounds check has already occurred, but this isn't observable yet --- In the future, once OOB accesses on TypedArrays actually throw, this will need to be refactored again), and in StoreFastElementStub, and ElementsTransitionAndStoreStub (via CSA::EmitElementStore). The change was not necessary in TurboFan, as JSNativeContextSpecialization already performs the value conversion before the boundscheck. The result is some fixed test262 tests, and some new test coverage for this behaviour in mjsunit. BUG=v8:7896, v8:5327 R=neis@chromium.org, jkummerow@chromium.org, gsathya@chromium.org Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Ibe6bec24c72ef6a4fd3e77d5bcafa03737f4c5e3 Reviewed-on: https://chromium-review.googlesource.com/1117372 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#54096}
65 lines
1.4 KiB
JavaScript
65 lines
1.4 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --harmony-bigint
|
|
|
|
let TypedArrayConstructors = [
|
|
BigUint64Array,
|
|
BigInt64Array,
|
|
];
|
|
|
|
// Test KeyedStore in uninitialized and monomorphic states.
|
|
for (let C of TypedArrayConstructors) {
|
|
let keyedSta = function(array) {
|
|
var didRun = false;
|
|
array[0] = {
|
|
valueOf() {
|
|
didRun = true;
|
|
return 42n;
|
|
}
|
|
};
|
|
|
|
return { didRun, array };
|
|
};
|
|
|
|
for (var i = 0; i < 3; ++i) {
|
|
var { didRun, array } = keyedSta(new C(1));
|
|
assertTrue(didRun);
|
|
assertEquals(array[0], 42n);
|
|
|
|
// OOB store
|
|
// FIXME: Throw a TypeError when storing OOB in a TypedArray.
|
|
var { didRun } = keyedSta(new C);
|
|
assertTrue(didRun);
|
|
}
|
|
}
|
|
|
|
// Test KeyedStore in polymorphic and megamorphic states.
|
|
do {
|
|
let keyedSta = function(array) {
|
|
var didRun = false;
|
|
array[0] = {
|
|
valueOf() {
|
|
didRun = true;
|
|
return 42n;
|
|
}
|
|
};
|
|
|
|
return { didRun, array };
|
|
};
|
|
|
|
for (var i = 0; i < 3; ++i) {
|
|
for (var C of TypedArrayConstructors) {
|
|
var { didRun, array } = keyedSta(new C(1));
|
|
assertTrue(didRun);
|
|
assertEquals(array[0], 42n);
|
|
|
|
// OOB store
|
|
// FIXME: Throw a TypeError when storing OOB in a TypedArray.
|
|
var { didRun } = keyedSta(new C);
|
|
assertTrue(didRun);
|
|
}
|
|
}
|
|
} while (false);
|