TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
https://bugs.webkit.org/show_bug.cgi?id=188875
Reviewed by Ross Kirsling.
JSTests:
* stress/typedarray-configure-index.js:
* test262/expectations.yaml: Mark 10 test cases as passing.
Source/JavaScriptCore:
This change implements steps 3.b.iv-v of TypedArray's [[DefineOwnProperty]] method [1],
preventing type errors from being thrown if descriptor lacks [[Enumerable]] or [[Writable]]
field and aligning JSC with V8 and SpiderMonkey.
[1]: https://tc39.es/ecma262/#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259444 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index a990fe1..bacf9b9 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,13 @@
+2020-04-02 Alexey Shvayka <shvaikalesh@gmail.com>
+
+ TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
+ https://bugs.webkit.org/show_bug.cgi?id=188875
+
+ Reviewed by Ross Kirsling.
+
+ * stress/typedarray-configure-index.js:
+ * test262/expectations.yaml: Mark 10 test cases as passing.
+
2020-04-01 Ross Kirsling <ross.kirsling@sony.com>
Intl.NumberFormat.prototype.format must preserve sign of -0
diff --git a/JSTests/stress/typedarray-configure-index.js b/JSTests/stress/typedarray-configure-index.js
index e82de0b..57aef37 100644
--- a/JSTests/stress/typedarray-configure-index.js
+++ b/JSTests/stress/typedarray-configure-index.js
@@ -42,9 +42,9 @@
let a = new constructor(10);
Object.defineProperty(a, 0, makeDescriptor(false, false, true, true));
assert(a[0] === 1);
- assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, true, false), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
- assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, false), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
- assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, true), "TypeError: Attempting to store non-enumerable or non-writable indexed property on a typed array."));
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, true, false), "TypeError: Attempting to store non-enumerable indexed property on a typed array."));
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, false), "TypeError: Attempting to store non-enumerable indexed property on a typed array."));
+ assertThrows(() => Object.defineProperty(a, 0, makeDescriptor(false, false, false, true), "TypeError: Attempting to store non-writable indexed property on a typed array."));
test(a, false, true, "TypeError: Attempting to configure non-configurable property.");
for (c of bools) {
diff --git a/JSTests/test262/expectations.yaml b/JSTests/test262/expectations.yaml
index 4de552b..1de93a0 100644
--- a/JSTests/test262/expectations.yaml
+++ b/JSTests/test262/expectations.yaml
@@ -1836,27 +1836,12 @@
test/built-ins/TypedArrayConstructors/from/set-value-abrupt-completion.js:
default: 'Test262Error: interrupted source iteration Expected SameValue(«1», «[object Object]») to be true (Testing with Float64Array.)'
strict mode: 'Test262Error: interrupted source iteration Expected SameValue(«1», «[object Object]») to be true (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/conversion-operation-consistent-nan.js:
- default: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float32Array.)'
- strict mode: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float32Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/conversion-operation.js:
- default: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float64Array.)'
- strict mode: 'TypeError: Attempting to store non-enumerable or non-writable property on a typed array at index: 0 (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/desc-value-throws.js:
- default: 'Test262Error: Expected a Test262Error but got a TypeError (Testing with Float64Array.)'
- strict mode: 'Test262Error: Expected a Test262Error but got a TypeError (Testing with Float64Array.)'
test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer-realm.js:
default: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
strict mode: 'Test262Error: Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/detached-buffer.js:
default: 'Test262Error: Throws TypeError on valid numeric index if instance has a detached buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
strict mode: 'Test262Error: Throws TypeError on valid numeric index if instance has a detached buffer Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/set-value.js:
- default: 'Test262Error: set value for sample[0] returns true Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
- strict mode: 'Test262Error: set value for sample[0] returns true Expected SameValue(«false», «true») to be true (Testing with Float64Array.)'
-test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/tonumber-value-detached-buffer.js:
- default: 'Test262Error: detaching a ArrayBuffer during defining an element of a typed array viewing it should throw Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
- strict mode: 'Test262Error: detaching a ArrayBuffer during defining an element of a typed array viewing it should throw Expected a TypeError to be thrown but no exception was thrown at all (Testing with Float64Array.)'
test/built-ins/TypedArrayConstructors/internals/Get/key-is-not-integer.js:
default: 'Test262Error: OrdinaryGet was called! Ref: 9.1.8.1 3.c (Testing with Float64Array.)'
strict mode: 'Test262Error: OrdinaryGet was called! Ref: 9.1.8.1 3.c (Testing with Float64Array.)'
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 1d599e8..aa9d8a8 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,19 @@
+2020-04-02 Alexey Shvayka <shvaikalesh@gmail.com>
+
+ TypedArray's [[DefineOwnProperty]] is incorrect with partial descriptors
+ https://bugs.webkit.org/show_bug.cgi?id=188875
+
+ Reviewed by Ross Kirsling.
+
+ This change implements steps 3.b.iv-v of TypedArray's [[DefineOwnProperty]] method [1],
+ preventing type errors from being thrown if descriptor lacks [[Enumerable]] or [[Writable]]
+ field and aligning JSC with V8 and SpiderMonkey.
+
+ [1]: https://tc39.es/ecma262/#sec-integer-indexed-exotic-objects-defineownproperty-p-desc
+
+ * runtime/JSGenericTypedArrayViewInlines.h:
+ (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+
2020-04-02 Commit Queue <commit-queue@webkit.org>
Unreviewed, reverting r259390.
diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
index 1a0cf59..a09b056 100644
--- a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
+++ b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
@@ -421,8 +421,11 @@
if (descriptor.configurable())
return throwTypeErrorIfNeeded("Attempting to configure non-configurable property on a typed array at index: ");
- if (!descriptor.enumerable() || !descriptor.writable())
- return throwTypeErrorIfNeeded("Attempting to store non-enumerable or non-writable property on a typed array at index: ");
+ if (descriptor.enumerablePresent() && !descriptor.enumerable())
+ return throwTypeErrorIfNeeded("Attempting to store non-enumerable property on a typed array at index: ");
+
+ if (descriptor.writablePresent() && !descriptor.writable())
+ return throwTypeErrorIfNeeded("Attempting to store non-writable property on a typed array at index: ");
if (descriptor.value())
RELEASE_AND_RETURN(scope, thisObject->putByIndex(thisObject, globalObject, index.value(), descriptor.value(), shouldThrow));
