Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b50d777c02d0b7be29979e7c0fe50d678918cb09
https://github.com/WebKit/WebKit/commit/b50d777c02d0b7be29979e7c0fe50d678918cb09
Author: Tetsuharu Ohzeki <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-biguint64.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-bitint64.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float16array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float32array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float64array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int16array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int32array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int8array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint32array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8array.js
A
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8clampledarray.js
A
JSTests/stress/typedarray-constructor-toindex-length-before-allocatetypedarray-if-1st-arg-not-object.js
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h
Log Message:
-----------
[JSC] test262 fail:
test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/throw-type-error-before-custom-proto-access.js
https://bugs.webkit.org/show_bug.cgi?id=314063
Reviewed by Yusuke Suzuki.
According to the spec https://tc39.es/ecma262/2026/#sec-typedarray
If the 1st argument of `new TypedArray(value)` is not an Object,
the step 9 |ToIndex(firstArgument)| should be executed before the step 10
|AllocateTypedArray|.
The current DFG/FTL implementation invoke the runtime code as a slow path
for the 1st argument is not int32/int52rep (DFG node would be
`NewTypedArray(UntypedUse)`).
Then |ToIndex(firstArgument)| is also delegated to the runtime.
To simplify this flow, this patch introduce
`operationConstructGenericTypedArrayViewWithOneArgumentImpl()`.
This patch adds new 2 kind of tests:
1. Simple port of test262's
test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/throw-type-error-before-custom-proto-access.js.
2. DFG/FTL delegate |ToIndex(firstArgument)| properly.
- Test variants named as
typedarray-constructor-jit-compliant-toindex-firstarg-*
Tests:
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-biguint64.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-bitint64.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float16array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float32array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float64array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int16array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int32array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int8array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint32array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8array.js
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8clampledarray.js
JSTests/stress/typedarray-constructor-toindex-length-before-allocatetypedarray-if-1st-arg-not-object.js
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-biguint64.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-bitint64.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float16array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float32array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float64array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int16array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int32array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int8array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint32array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8array.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8clampledarray.js:
Added.
(shouldThrow):
*
JSTests/stress/typedarray-constructor-toindex-length-before-allocatetypedarray-if-1st-arg-not-object.js:
Added.
(shouldThrow):
(const.newTarget):
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::operationConstructGenericTypedArrayViewWithOneArgumentImpl):
(JSC::constructGenericTypedArrayViewImpl):
Canonical link: https://commits.webkit.org/316237@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
