nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/regress-155776-expected.txt

11 lines
234 B
Plaintext
Raw Permalink Normal View History

JavaScriptCore ArrayPrototype::join shouldn't cache butterfly when it makes effectful calls https://bugs.webkit.org/show_bug.cgi?id=155776 Reviewed by Saam Barati. Source/JavaScriptCore: Array.join ends up calling toString, possibly on some object. Since these calls could be effectful and could change the array itself, we can't hold the butterfly pointer while making effectful calls. Changed the code to fall back to the general case when an effectful toString() call might be made. * runtime/ArrayPrototype.cpp: (JSC::join): * runtime/JSStringJoiner.h: (JSC::JSStringJoiner::appendWithoutSideEffects): New helper that doesn't make effectful toString() calls. (JSC::JSStringJoiner::append): Built upon appendWithoutSideEffects. LayoutTests: New test. * js/regress-155776-expected.txt: Added. * js/regress-155776.html: Added. * js/script-tests/regress-155776.js: Added. (fillBigArrayViaToString): (Function.prototype.toString): Canonical link: https://commits.webkit.org/173907@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@198592 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-03-23 21:03:02 +00:00
Regresion test for 155776. This test should pass and not crash.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS stringResult is expectedString
PASS successfullyParsed is true
TEST COMPLETE