Skip to content

Commit d2b0aa2

Browse files
Jarred-SumnerJarred-Sumner
committed
Merge remote-tracking branch 'upstream'
2 parents 0a0a8f3 + fcd917d commit d2b0aa2

33 files changed

+354
-74
lines changed

‎JSTests/stress/array-fast-fill-beyond-length.js

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
const v0 = [];
2+
for (let i2 = 0; i2 < 1000000; i2++) {
3+
v0[i2] = [];
4+
}
5+
const v10 = new Object(Object, v0);
6+
function f11() {
7+
v0.length = 0;
8+
return 0;
9+
}
10+
const o14 = {
11+
"valueOf": f11,
12+
};
13+
v0.fill(v10, o14);

‎JSTests/stress/reduce-assertNoException.js

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
//@ runDefault("--watchdog=500", "--watchdog-exception-ok")
2+
function placeholder() {}
3+
function main() {
4+
const z48431 = [0.4, 1145324612];
5+
for (let v4 = 0; v4 < 100; v4++) {
6+
const v6 = Array(46139);
7+
let v7 = undefined;
8+
const v9 = class V9 extends Int16Array {
9+
constructor(v11, v12, v13) {
10+
super();
11+
}
12+
split() {
13+
return 'Test262Error: ' + this.message;
14+
}
15+
};
16+
const v16 = new v9();
17+
function v18(v19, v20, v21, v22) {
18+
v7 = forceGCSlowPaths;
19+
}
20+
}
21+
const z570009 = [0.4, 1145324612];
22+
const z676068 = [0.4, 1145324612];
23+
const v23 = 0;
24+
const v24 = 100;
25+
const z106237 = [0.4, 1145324612];
26+
const z788844 = [0.4, 1145324612];
27+
const z115753 = [0.4, 1145324612];
28+
const z913254 = [0.4, 1145324612];
29+
const z438038 = [0.4, 1145324612];
30+
const v25 = 1;
31+
for (let v29 = 0; v29 < 1099511627776n; v29++) {
32+
async function* v30(v31, v32, v33, a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10) {}
33+
const v34 = v30();
34+
}
35+
const z637976 = [0.4, 1145324612];
36+
gc();
37+
const z112286 = [0.4, 134217728n];
38+
const z709419 = [0.4, 1145324612];
39+
}
40+
noDFG(main);
41+
noFTL(main);
42+
main();

‎JSTests/stress/to-this-flags.js

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
try {
2+
const x = Object.getOwnPropertyDescriptor(RegExp.prototype, "flags").get;
3+
x();
4+
const sticky = 0;
5+
} catch { }

‎JSTests/wasm/stress/catch-function-signature.js

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
try {
2+
let v17 = 96;
3+
let v28 = -4294967295;
4+
const v29 = ++v28;
5+
const v30 = -v17;
6+
const v32 = v29 && --v17;
7+
+v28;
8+
v32 ^ v32;
9+
Math.asinh(v30);
10+
const o87 = {
11+
"maxByteLength": 2,
12+
};
13+
const v89 = new SharedArrayBuffer(0, o87);
14+
new Uint8Array(v89);
15+
const v94 = new Uint8Array([0,97,115,109,1,0,0,0,1,9,2,v17,1,127,0,96,1,127,0,2,8,1,1,109,1,116,4,0,0,3,2,1,1,7,9,1,5,116,104,114,111,119,0,0,10,8,1,6,0,32,0,8,0,11,0,15,4,110,97,109,101,1,8,1,0,5,116,104,114,111,119]);
16+
const t20 = WebAssembly.Module;
17+
new t20(v94);
18+
} catch { }

‎LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/reference/sideways-lr-main-axis-ref.html

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!DOCTYPE html>
2+
<title>Reference: sideways-lr flexbox main axis progresses in correct direction</title>
3+
<style>
4+
.container {
5+
font-size: 0
6+
}
7+
.item {
8+
width: 20px;
9+
height: 20px;
10+
}
11+
12+
.item:nth-child(1) { background-color: lime; }
13+
.item:nth-child(2) { background-color: limegreen; }
14+
.item:nth-child(3) { background-color: green; }
15+
16+
.container.reverse .item:nth-child(1) { background-color: green; }
17+
.container.reverse .item:nth-child(2) { background-color: limegreen; }
18+
.container.reverse .item:nth-child(3) { background-color: lime; }
19+
20+
.container.row .item { display: inline-block; }
21+
</style>
22+
<div class="container reverse">
23+
<div class="item"></div>
24+
<div class="item"></div>
25+
<div class="item"></div>
26+
</div>
27+
<div class="container">
28+
<div class="item"></div>
29+
<div class="item"></div>
30+
<div class="item"></div>
31+
</div>
32+
<div class="container">
33+
<div class="item"></div>
34+
<div class="item"></div>
35+
<div class="item"></div>
36+
</div>
37+
<div class="container reverse">
38+
<div class="item"></div>
39+
<div class="item"></div>
40+
<div class="item"></div>
41+
</div>
42+
<div class="container row">
43+
<div class="item"></div>
44+
<div class="item"></div>
45+
<div class="item"></div>
46+
</div>
47+
<div class="container row">
48+
<div class="item"></div>
49+
<div class="item"></div>
50+
<div class="item"></div>
51+
</div>
52+
<div class="container row reverse">
53+
<div class="item"></div>
54+
<div class="item"></div>
55+
<div class="item"></div>
56+
</div>
57+
<div class="container row reverse">
58+
<div class="item"></div>
59+
<div class="item"></div>
60+
<div class="item"></div>
61+
</div>

‎LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/sideways-lr-main-axis-expected.html

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!DOCTYPE html>
2+
<title>Reference: sideways-lr flexbox main axis progresses in correct direction</title>
3+
<style>
4+
.container {
5+
font-size: 0
6+
}
7+
.item {
8+
width: 20px;
9+
height: 20px;
10+
}
11+
12+
.item:nth-child(1) { background-color: lime; }
13+
.item:nth-child(2) { background-color: limegreen; }
14+
.item:nth-child(3) { background-color: green; }
15+
16+
.container.reverse .item:nth-child(1) { background-color: green; }
17+
.container.reverse .item:nth-child(2) { background-color: limegreen; }
18+
.container.reverse .item:nth-child(3) { background-color: lime; }
19+
20+
.container.row .item { display: inline-block; }
21+
</style>
22+
<div class="container reverse">
23+
<div class="item"></div>
24+
<div class="item"></div>
25+
<div class="item"></div>
26+
</div>
27+
<div class="container">
28+
<div class="item"></div>
29+
<div class="item"></div>
30+
<div class="item"></div>
31+
</div>
32+
<div class="container">
33+
<div class="item"></div>
34+
<div class="item"></div>
35+
<div class="item"></div>
36+
</div>
37+
<div class="container reverse">
38+
<div class="item"></div>
39+
<div class="item"></div>
40+
<div class="item"></div>
41+
</div>
42+
<div class="container row">
43+
<div class="item"></div>
44+
<div class="item"></div>
45+
<div class="item"></div>
46+
</div>
47+
<div class="container row">
48+
<div class="item"></div>
49+
<div class="item"></div>
50+
<div class="item"></div>
51+
</div>
52+
<div class="container row reverse">
53+
<div class="item"></div>
54+
<div class="item"></div>
55+
<div class="item"></div>
56+
</div>
57+
<div class="container row reverse">
58+
<div class="item"></div>
59+
<div class="item"></div>
60+
<div class="item"></div>
61+
</div>

‎LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/sideways-lr-main-axis.html

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<!DOCTYPE html>
2+
<title>sideways-lr flexbox main axis progresses in correct direction</title>
3+
<link rel="author" title="Tim Nguyen" href="https://github.com/nt1m">
4+
<link rel="help" href="https://drafts.csswg.org/css-flexbox-1/#box-model">
5+
<link rel="match" href="reference/sideways-lr-main-axis-ref.html">
6+
<style>
7+
.container {
8+
display: flex;
9+
}
10+
.item {
11+
width: 20px;
12+
height: 20px;
13+
}
14+
.item:nth-child(1) { background-color: lime; }
15+
.item:nth-child(2) { background-color: limegreen; }
16+
.item:nth-child(3) { background-color: green; }
17+
</style>
18+
<div class="container" style="writing-mode: sideways-lr; flex-direction: row;">
19+
<div class="item"></div>
20+
<div class="item"></div>
21+
<div class="item"></div>
22+
</div>
23+
<div class="container" style="writing-mode: sideways-lr; direction: rtl; flex-direction: row;">
24+
<div class="item"></div>
25+
<div class="item"></div>
26+
<div class="item"></div>
27+
</div>
28+
<div class="container" style="writing-mode: sideways-lr; flex-direction: row-reverse;">
29+
<div class="item"></div>
30+
<div class="item"></div>
31+
<div class="item"></div>
32+
</div>
33+
<div class="container" style="writing-mode: sideways-lr; direction: rtl; flex-direction: row-reverse;">
34+
<div class="item"></div>
35+
<div class="item"></div>
36+
<div class="item"></div>
37+
</div>
38+
<div class="container" style="writing-mode: sideways-lr; flex-direction: column;">
39+
<div class="item"></div>
40+
<div class="item"></div>
41+
<div class="item"></div>
42+
</div>
43+
<div class="container" style="writing-mode: sideways-lr; direction: rtl; flex-direction: column;">
44+
<div class="item"></div>
45+
<div class="item"></div>
46+
<div class="item"></div>
47+
</div>
48+
<div class="container" style="writing-mode: sideways-lr; flex-direction: column-reverse;">
49+
<div class="item"></div>
50+
<div class="item"></div>
51+
<div class="item"></div>
52+
</div>
53+
<div class="container" style="writing-mode: sideways-lr; direction: rtl; flex-direction: column-reverse;">
54+
<div class="item"></div>
55+
<div class="item"></div>
56+
<div class="item"></div>
57+
</div>

‎Source/JavaScriptCore/runtime/InternalFunction.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ Structure* InternalFunction::createSubclassStructure(JSGlobalObject* globalObjec
166166

167167
// .prototype can't be a getter if we canUseAllocationProfiles().
168168
JSValue prototypeValue = targetFunction->get(globalObject, vm.propertyNames->prototype);
169-
scope.assertNoException();
169+
RETURN_IF_EXCEPTION(scope, nullptr);
170170

171171
if (JSObject* prototype = jsDynamicCast<JSObject*>(prototypeValue))
172172
return rareData->createInternalFunctionAllocationStructureFromBase(vm, baseGlobalObject, prototype, baseClass);

‎Source/JavaScriptCore/runtime/JSArray.cpp

+4
Original file line numberDiff line numberDiff line change
@@ -496,6 +496,10 @@ bool JSArray::fastFill(VM& vm, unsigned startIndex, unsigned endIndex, JSValue v
496496

497497
ASSERT(nextType == indexingType());
498498

499+
// There is a chance that endIndex is beyond the length. If it is, let's just fail.
500+
if (endIndex > this->butterfly()->publicLength())
501+
return false;
502+
499503
if (nextType == ArrayWithDouble) {
500504
auto* data = butterfly()->contiguousDouble().data();
501505
double pattern = value.asNumber();

‎Source/JavaScriptCore/runtime/RegExpPrototype.cpp

+10-6
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,9 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoFuncToString, (JSGlobalObject* globalObject,
199199
auto scope = DECLARE_THROW_SCOPE(vm);
200200

201201
JSValue thisValue = callFrame->thisValue().toThis(globalObject, ECMAMode::strict());
202-
if (!thisValue.isObject())
202+
RETURN_IF_EXCEPTION(scope, { });
203+
204+
if (UNLIKELY(!thisValue.isObject()))
203205
return throwVMTypeError(globalObject, scope);
204206

205207
JSObject* thisObject = asObject(thisValue);
@@ -211,14 +213,14 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoFuncToString, (JSGlobalObject* globalObject,
211213
return JSValue::encode(earlyReturnValue);
212214

213215
JSValue sourceValue = thisObject->get(globalObject, vm.propertyNames->source);
214-
RETURN_IF_EXCEPTION(scope, encodedJSValue());
216+
RETURN_IF_EXCEPTION(scope, { });
215217
String source = sourceValue.toWTFString(globalObject);
216-
RETURN_IF_EXCEPTION(scope, encodedJSValue());
218+
RETURN_IF_EXCEPTION(scope, { });
217219

218220
JSValue flagsValue = thisObject->get(globalObject, vm.propertyNames->flags);
219-
RETURN_IF_EXCEPTION(scope, encodedJSValue());
221+
RETURN_IF_EXCEPTION(scope, { });
220222
String flags = flagsValue.toWTFString(globalObject);
221-
RETURN_IF_EXCEPTION(scope, encodedJSValue());
223+
RETURN_IF_EXCEPTION(scope, { });
222224

223225
RELEASE_AND_RETURN(scope, JSValue::encode(jsMakeNontrivialString(globalObject, '/', source, '/', flags)));
224226
}
@@ -356,7 +358,9 @@ JSC_DEFINE_HOST_FUNCTION(regExpProtoGetterFlags, (JSGlobalObject* globalObject,
356358
VM& vm = globalObject->vm();
357359
auto scope = DECLARE_THROW_SCOPE(vm);
358360

359-
JSValue thisValue = callFrame->thisValue();
361+
JSValue thisValue = callFrame->thisValue().toThis(globalObject, ECMAMode::strict());
362+
RETURN_IF_EXCEPTION(scope, { });
363+
360364
if (UNLIKELY(!thisValue.isObject()))
361365
return throwVMTypeError(globalObject, scope, "The RegExp.prototype.flags getter can only be called on an object"_s);
362366

0 commit comments

Comments
 (0)