fries/quickjs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Handle TypedArray detach during iteration (#209)

Browse source 
Per spec: detaching the TA mid-iteration is allowed.

TypedArray.prototype.sort should not throw an exception when that
happens and now no longer does.
This commit is contained in:
Ben Noordhuis 2023-12-13 08:55:01 +01:00 committed by GitHub
parent 8baafc46bd
commit 5168db1965
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
quickjs.c
View file

@ -49591,8 +49591,13 @@ static int js_TA_cmp_generic(const void *a, const void *b, void *opaque) {
uint32_t a_idx, b_idx;
JSValue argv[2];
JSValue res;
JSObject *p;
int cmp;
p = JS_VALUE_GET_OBJ(psc->arr);
if (typed_array_is_detached(ctx, p))
return 0;
cmp = 0;
if (!psc->exception) {
a_idx = *(uint32_t *)a;
@ -49622,9 +49627,6 @@ static int js_TA_cmp_generic(const void *a, const void *b, void *opaque) {
/* make sort stable: compare array offsets */
cmp = (a_idx > b_idx) - (a_idx < b_idx);
}
if (validate_typed_array(ctx, psc->arr) < 0) {
psc->exception = 1;
}
done:
JS_FreeValue(ctx, (JSValue)argv[0]);
JS_FreeValue(ctx, (JSValue)argv[1]);
@ -49719,6 +49721,9 @@ static JSValue js_typed_array_sort(JSContext *ctx, JSValue this_val,
js_TA_cmp_generic, &tsc);
if (tsc.exception)
goto fail;
// per spec: typed array can be detached mid-iteration
if (typed_array_is_detached(ctx, p))
goto done;
array_tmp = js_malloc(ctx, len * elt_size);
if (!array_tmp) {
fail:
@ -49755,6 +49760,7 @@ static JSValue js_typed_array_sort(JSContext *ctx, JSValue this_val,
abort();
}
js_free(ctx, array_tmp);
done:
js_free(ctx, array_idx);
} else {
rqsort(array_ptr, len, elt_size, cmpfun, &tsc);

2
test262_errors.txt
View file

@ -3,8 +3,6 @@ test262/test/built-ins/AsyncGeneratorPrototype/return/return-suspendedYield-brok
test262/test/built-ins/AsyncGeneratorPrototype/return/return-suspendedYield-broken-promise-try-catch.js:39: strict mode: TypeError: $DONE() not called
test262/test/built-ins/RegExp/lookahead-quantifier-match-groups.js:27: Test262Error: Expected [a, abc] and [a, undefined] to have the same contents. ? quantifier
test262/test/built-ins/RegExp/lookahead-quantifier-match-groups.js:27: strict mode: Test262Error: Expected [a, abc] and [a, undefined] to have the same contents. ? quantifier
test262/test/built-ins/TypedArray/prototype/sort/sort-tonumber.js:30: TypeError: ArrayBuffer is detached (Testing with Float64Array.)
test262/test/built-ins/TypedArray/prototype/sort/sort-tonumber.js:30: strict mode: TypeError: ArrayBuffer is detached (Testing with Float64Array.)
test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer.js:46: Test262Error: (Testing with BigInt64Array.)
test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/detached-buffer.js:46: strict mode: Test262Error: (Testing with BigInt64Array.)
test262/test/built-ins/TypedArrayConstructors/internals/DefineOwnProperty/BigInt/tonumber-value-detached-buffer.js:40: Test262Error: Reflect.defineProperty(ta, 0, {value: {valueOf() {$DETACHBUFFER(ta.buffer); return 42n;}}}) must return true Expected SameValue(«false», «true») to be true (Testing with BigInt64Array.)