Changeset 220377 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Aug 7, 2017, 7:29:42 PM (8 years ago)

Author:

[email protected]

Message:

GetOwnProperty of TypedArray indexed fields is wrongly configurable
​https://bugs.webkit.org/show_bug.cgi?id=175307

Patch by Robin Morisset <​[email protected]> on 2017-08-07
Reviewed by Saam Barati.

JSTests:

• stress/typedarray-getownproperty-not-configurable.js: Added.

(assert):
(foo):

Source/JavaScriptCore:

`
let a = new Uint8Array(10);
let b = Object.getOwnPropertyDescriptor(a, 0);
assert(b.configurable === false);
`
should not fail: by section 9.4.5.1 (​https://tc39.github.io/ecma262/#sec-integer-indexed-exotic-objects-getownproperty-p)
that applies to integer indexed exotic objects, and section 22.2.7 (​https://tc39.github.io/ecma262/#sec-properties-of-typedarray-instances)
that says that typed arrays are integer indexed exotic objects.

• runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-08-07  Robin Morisset  <[email protected]>
+
+        GetOwnProperty of TypedArray indexed fields is wrongly configurable
+        https://bugs.webkit.org/show_bug.cgi?id=175307
+
+        Reviewed by Saam Barati.
+
+        ```
+        let a = new Uint8Array(10);
+        let b = Object.getOwnPropertyDescriptor(a, 0);
+        assert(b.configurable === false);
+        ```
+        should not fail: by section 9.4.5.1 (https://tc39.github.io/ecma262/#sec-integer-indexed-exotic-objects-getownproperty-p) 
+        that applies to integer indexed exotic objects, and section 22.2.7 (https://tc39.github.io/ecma262/#sec-properties-of-typedarray-instances)
+        that says that typed arrays are integer indexed exotic objects.
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
+
 2017-08-07  Filip Pizlo  <[email protected]>