Open
Bug 1640194
Opened 4 years ago
Updated 1 year ago
TypedArraySpeciesCreate needs to validate [[ContentType]]
Categories
(Core :: JavaScript: Standard Library, defect, P3)
Core
JavaScript: Standard Library
Tracking
()
ASSIGNED
Tracking | Status | |
---|---|---|
firefox78 | --- | affected |
People
(Reporter: anba, Assigned: anba)
Details
Attachments
(1 file)
TypedArraySpeciesCreate, step 6 isn't currently implemented:
- If result.[[ContentType]] is not equal to exemplar.[[ContentType]], throw a TypeError exception.
Example:
var ta = new Float64Array(0);
ta.constructor = BigInt64Array;
var result = ta.slice(0);
Expected: Throws TypeError
.
Actual: No error thrown.
The closest intrinsic to validate the type is GetTypedArrayKind
, but that one isn't currently inlinable, which means there'll be a performance cost using it for TypedArraySpeciesCreate
.
Assignee | ||
Updated•4 years ago
|
Assignee: nobody → andrebargull
Status: NEW → ASSIGNED
Assignee | ||
Comment 1•4 years ago
|
||
Add PossiblyWrappedTypedArrayIsBigInt
to check if a TypedArray uses BigInt elements:
- Testing for BigInt TypedArrays matches what we do in C++ code.
- Uses
UnwrapAndDowncastValue
instead ofmaybeUnwrapAs
, because dead object
wrappers are possible for this case. - Has basic inlining support to avoid regressing the TypedArray built-ins like
slice
, which were previously optimised to use fully inlinable TypedArray
allocation.
Drive-by change:
- Update
TypedArrayFill
to use the new inlinable helper function.
Comment 2•4 years ago
|
||
The severity field is not set for this bug.
:jorendorff, could you have a look please?
For more information, please visit auto_nag documentation.
Flags: needinfo?(jorendorff)
Updated•4 years ago
|
Severity: -- → S4
Priority: -- → P3
Comment 3•4 years ago
|
||
The proposal to dismantle @@species would indeed remove this whole function.
It'll probably go forward, but it'll be a while. :-\
Flags: needinfo?(jorendorff)
You need to log in
before you can comment on or make changes to this bug.
Description
•