Title: [266641] trunk/Source/_javascript_Core
- Revision
- 266641
- Author
- [email protected]
- Date
- 2020-09-04 15:33:55 -0700 (Fri, 04 Sep 2020)
Log Message
Array.prototype.push should always perform [[Set]] in strict mode
https://bugs.webkit.org/show_bug.cgi?id=216121
Unreviewed, address Darin's feedback on r266581.
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncPush): Remove unnecessary static_cast<uint64_t>.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (266640 => 266641)
--- trunk/Source/_javascript_Core/ChangeLog 2020-09-04 22:29:23 UTC (rev 266640)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-09-04 22:33:55 UTC (rev 266641)
@@ -3,6 +3,16 @@
Array.prototype.push should always perform [[Set]] in strict mode
https://bugs.webkit.org/show_bug.cgi?id=216121
+ Unreviewed, address Darin's feedback on r266581.
+
+ * runtime/ArrayPrototype.cpp:
+ (JSC::arrayProtoFuncPush): Remove unnecessary static_cast<uint64_t>.
+
+2020-09-04 Alexey Shvayka <[email protected]>
+
+ Array.prototype.push should always perform [[Set]] in strict mode
+ https://bugs.webkit.org/show_bug.cgi?id=216121
+
Reviewed by Darin Adler.
This patch fixes arrayProtoFuncPush() to throw a TypeError if putting an
Modified: trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp (266640 => 266641)
--- trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2020-09-04 22:29:23 UTC (rev 266640)
+++ trunk/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2020-09-04 22:33:55 UTC (rev 266641)
@@ -916,7 +916,7 @@
return throwVMTypeError(globalObject, scope, "push cannot produce an array of length larger than (2 ** 53) - 1"_s);
for (unsigned n = 0; n < argCount; n++) {
- thisObj->putByIndexInline(globalObject, static_cast<uint64_t>(length + n), callFrame->uncheckedArgument(n), true);
+ thisObj->putByIndexInline(globalObject, length + n, callFrame->uncheckedArgument(n), true);
RETURN_IF_EXCEPTION(scope, { });
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
