Remove check for per-comparator call detach check in TypedArray.prototype.sort

This updates tests in line with the normative change in
https://github.com/tc39/ecma262/pull/2723
This commit is contained in:
Shu-yu Guo 2022-04-04 16:36:56 -07:00 committed by rwaldron
parent 3ac6b73369
commit d7c0a2076c
4 changed files with 6 additions and 130 deletions

View File

@ -1,38 +0,0 @@
// Copyright (C) 2016 the V8 project authors. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-%typedarray%.prototype.sort
description: Throws a TypeError if comparefn detaches the object buffer
info: |
22.2.3.26 %TypedArray%.prototype.sort ( comparefn )
When the TypedArray SortCompare abstract operation is called with two
arguments x and y, the following steps are taken:
...
2. If the argument comparefn is not undefined, then
a. Let v be ? Call(comparefn, undefined, « x, y »).
b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
...
...
includes: [testBigIntTypedArray.js, detachArrayBuffer.js]
features: [BigInt, TypedArray]
---*/
testWithBigIntTypedArrayConstructors(function(TA) {
var sample = new TA(4);
var calls = 0;
var comparefn = function() {
if (calls > 0) {
throw new Test262Error();
}
calls++;
$DETACHBUFFER(sample.buffer);
};
assert.throws(TypeError, function() {
sample.sort(comparefn);
});
assert.sameValue(calls, 1);
});

View File

@ -1,44 +0,0 @@
// Copyright (C) 2020 Google. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-%typedarray%.prototype.sort
description: >
SECURITY Throws a TypeError if coercion of the comparefn return value
detaches the object buffer
info: |
22.2.3.26 %TypedArray%.prototype.sort ( comparefn )
When the TypedArray SortCompare abstract operation is called with two
arguments x and y, the following steps are taken:
...
2. If the argument comparefn is not undefined, then
a. Let v be ? ToNumber(? Call(comparefn, undefined, « x, y »)).
b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
...
...
includes: [testTypedArray.js, detachArrayBuffer.js]
features: [TypedArray]
---*/
testWithTypedArrayConstructors(function(TA) {
var sample = new TA(4);
var calls = 0;
var convertfn = function(){
$DETACHBUFFER(sample.buffer);
return 1;
}
var comparefn = function() {
if (calls > 0) {
throw new Test262Error();
}
calls++;
return {valueOf : convertfn}
};
assert.throws(TypeError, function() {
sample.sort(comparefn);
}, "Coercion that detaches buffer should throw TypeError");
assert.sameValue(calls, 1);
});

View File

@ -1,38 +0,0 @@
// Copyright (C) 2016 the V8 project authors. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-%typedarray%.prototype.sort
description: Throws a TypeError if comparefn detaches the object buffer
info: |
22.2.3.26 %TypedArray%.prototype.sort ( comparefn )
When the TypedArray SortCompare abstract operation is called with two
arguments x and y, the following steps are taken:
...
2. If the argument comparefn is not undefined, then
a. Let v be ? Call(comparefn, undefined, « x, y »).
b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
...
...
includes: [testTypedArray.js, detachArrayBuffer.js]
features: [TypedArray]
---*/
testWithTypedArrayConstructors(function(TA) {
var sample = new TA(4);
var calls = 0;
var comparefn = function() {
if (calls > 0) {
throw new Test262Error();
}
calls++;
$DETACHBUFFER(sample.buffer);
};
assert.throws(TypeError, function() {
sample.sort(comparefn);
});
assert.sameValue(calls, 1);
});

View File

@ -21,17 +21,13 @@ testWithTypedArrayConstructors(function(TA) {
var ab = ta.buffer;
var called = false;
assert.throws(TypeError, function() {
ta.sort(function(a, b) {
// IsDetachedBuffer is checked right after calling comparefn.
// So, detach the ArrayBuffer to cause sort to throw, to make sure we're actually calling ToNumber immediately (as spec'd)
// (a possible bug is to wait until the result is inspected to call ToNumber, rather than immediately)
// Detaching the buffer does not cause sort to throw.
$DETACHBUFFER(ab);
return {
[Symbol.toPrimitive]() { called = true; }
};
});
});
assert.sameValue(true, called);
});