[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
Gustavo Noronha Silva
gns at gnome.org
Thu Apr 8 02:24:34 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit c77dd89cf55c7b44fcfb6a76e3c65d01ab953393
Author: ap at apple.com <ap at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Tue Mar 23 23:12:10 2010 +0000
Reviewed by Geoff Garen.
https://bugs.webkit.org/show_bug.cgi?id=36511
<rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
* runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
the start offset, and iterated over (almost) all integers. Note that this can be fixed
without using doubles, but the code would be much more complicated, and there is no important
reason to stick to integers here.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@56425 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 622b6ec..3dbba7b 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2010-03-23 Alexey Proskuryakov <ap at apple.com>
+
+ Reviewed by Geoff Garen.
+
+ https://bugs.webkit.org/show_bug.cgi?id=36511
+ <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+ Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
+
+ * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
+ the start offset, and iterated over (almost) all integers. Note that this can be fixed
+ without using doubles, but the code would be much more complicated, and there is no important
+ reason to stick to integers here.
+
2010-03-23 Kent Hansen <kent.hansen at nokia.com>
Reviewed by Darin Adler.
diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index 7aacb8d..99e3d4e 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -506,14 +506,19 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
// 15.4.4.12
JSArray* resObj = constructEmptyArray(exec);
JSValue result = resObj;
- unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+
+ // FIXME: Firefox returns an empty array.
if (!args.size())
return jsUndefined();
- int begin = args.at(0).toUInt32(exec);
- if (begin < 0)
- begin = std::max<int>(begin + length, 0);
- else
- begin = std::min<int>(begin, length);
+
+ unsigned length = thisObj->get(exec, exec->propertyNames().length).toInteger(exec);
+ double relativeBegin = args.at(0).toInteger(exec);
+ unsigned begin;
+ if (relativeBegin < 0) {
+ relativeBegin += length;
+ begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
+ } else
+ begin = std::min<unsigned>(relativeBegin, length);
unsigned deleteCount;
if (args.size() > 1)
@@ -539,7 +544,7 @@ JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue t
for (unsigned k = length; k > length - deleteCount + additionalArgs; --k)
thisObj->deleteProperty(exec, k - 1);
} else {
- for (unsigned k = length - deleteCount; (int)k > begin; --k) {
+ for (unsigned k = length - deleteCount; k > begin; --k) {
if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
thisObj->put(exec, k + additionalArgs - 1, obj);
else
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4c5cd6a..303b0fd 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2010-03-23 Alexey Proskuryakov <ap at apple.com>
+
+ Reviewed by Geoff Garen.
+
+ https://bugs.webkit.org/show_bug.cgi?id=36511
+ <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+ Landing the troublesome test. Will need to be deleted when we properly import the whole test
+ suite.
+
+ * fast/js/script-tests/sputnik-S15.4.4.12_A3_T3.js: Added.
+ * fast/js/sputnik-S15.4.4.12_A3_T3-expected.txt: Added.
+ * fast/js/sputnik-S15.4.4.12_A3_T3.html: Added.
+
2010-03-23 Chris Evans <cevans at chromium.org>
Reviewed by Darin Adler.
diff --git a/LayoutTests/fast/js/script-tests/sputnik-S15.4.4.12_A3_T3.js b/LayoutTests/fast/js/script-tests/sputnik-S15.4.4.12_A3_T3.js
new file mode 100644
index 0000000..f708e51
--- /dev/null
+++ b/LayoutTests/fast/js/script-tests/sputnik-S15.4.4.12_A3_T3.js
@@ -0,0 +1,69 @@
+/*
+ Copyright 2009 the Sputnik authors. All rights reserved.
+ Copyright (C) 2010 Apple Inc. All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are
+ met:
+
+ * Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above
+ copyright notice, this list of conditions and the following
+ disclaimer in the documentation and/or other materials provided
+ with the distribution.
+ * Neither the name of Google Inc. nor the names of its
+ contributors may be used to endorse or promote products derived
+ from this software without specific prior written permission.
+
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+description('Sputnik test S15.4.4.12_A3_T3.');
+
+$ERROR = testFailed;
+
+/**
+ * @name: S15.4.4.12_A3_T3;
+ * @section: 15.4.4.12;
+ * @assertion: Check ToUint32(length) for non Array objects;
+ * @description: length is arbitrarily;
+*/
+
+var obj = {};
+obj.splice = Array.prototype.splice;
+obj[4294967294] = "x";
+obj.length = -1;
+var arr = obj.splice(4294967294,1);
+
+//CHECK#1
+if (arr.length !== 1) {
+ $ERROR('#1: var obj = {}; obj.splice = Array.prototype.splice; obj[4294967294] = "x"; obj.length = -1; var arr = obj.splice(4294967294,1); arr.length === 1. Actual: ' + (arr.length));
+}
+
+//CHECK#2
+if (arr[0] !== "x") {
+ $ERROR('#2: var obj = {}; obj.splice = Array.prototype.splice; obj[4294967294] = "x"; obj.length = 1; var arr = obj.splice(4294967294,1); arr[0] === "x". Actual: ' + (arr[0]));
+}
+
+//CHECK#3
+if (obj.length !== 4294967294) {
+ $ERROR('#3: var obj = {}; obj.splice = Array.prototype.splice; obj[4294967294] = "x"; obj.length = 1; var arr = obj.splice(4294967294,1); obj.length === 4294967294. Actual: ' + (obj.length));
+}
+
+//CHECK#4
+if (obj[4294967294] !== undefined) {
+ $ERROR('#4: var obj = {}; obj.splice = Array.prototype.splice; obj[4294967294] = "x"; obj.length = 1; var arr = obj.splice(4294967294,1); obj[4294967294] === undefined. Actual: ' + (obj[4294967294]));
+}
+
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/js/sputnik-S15.4.4.12_A3_T3-expected.txt b/LayoutTests/fast/js/sputnik-S15.4.4.12_A3_T3-expected.txt
new file mode 100644
index 0000000..67338a0
--- /dev/null
+++ b/LayoutTests/fast/js/sputnik-S15.4.4.12_A3_T3-expected.txt
@@ -0,0 +1,9 @@
+Sputnik test S15.4.4.12_A3_T3.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/sputnik-S15.4.4.12_A3_T3.html b/LayoutTests/fast/js/sputnik-S15.4.4.12_A3_T3.html
new file mode 100644
index 0000000..f4d5f43
--- /dev/null
+++ b/LayoutTests/fast/js/sputnik-S15.4.4.12_A3_T3.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/sputnik-S15.4.4.12_A3_T3.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list