Skip to content

Commit 9ea3919

Browse files
committed
[MERGE #6176 @akroshg] Fix for TypedArray.prototype.fill
Merge pull request #6176 from akroshg:issue6174 We need to call ToNumber for the fill value first before go for filling values for TypedArray.prototype.fill case.
2 parents 825849b + b4b4770 commit 9ea3919

File tree

2 files changed

+23
-1
lines changed

2 files changed

+23
-1
lines changed

lib/Runtime/Library/JavascriptArray.cpp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9391,9 +9391,10 @@ using namespace Js;
93919391
Assert(args.Info.Count > 0);
93929392

93939393
JavascriptLibrary* library = scriptContext->GetLibrary();
9394+
bool isTypedArrayEntryPoint = typedArrayBase != nullptr;
93949395

93959396
// If we came from Array.prototype.fill and source object is not a JavascriptArray, source could be a TypedArray
9396-
if (typedArrayBase == nullptr && pArr == nullptr && VarIs<TypedArrayBase>(obj))
9397+
if (!isTypedArrayEntryPoint && pArr == nullptr && VarIs<TypedArrayBase>(obj))
93979398
{
93989399
typedArrayBase = UnsafeVarTo<TypedArrayBase>(obj);
93999400
}
@@ -9403,6 +9404,10 @@ using namespace Js;
94039404
if (args.Info.Count > 1)
94049405
{
94059406
fillValue = args[1];
9407+
if (isTypedArrayEntryPoint)
9408+
{
9409+
JS_REENTRANT_UNLOCK(jsReentLock, fillValue = JavascriptNumber::ToVarNoCheck(JavascriptConversion::ToNumber(fillValue, scriptContext), scriptContext));
9410+
}
94069411
}
94079412
else
94089413
{

test/Bugs/misc_bugs.js

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,23 @@ var tests = [
271271
assert.throws(() => { new var_2([]).var_3(); },TypeError);
272272
}
273273
},
274+
{
275+
name: "issue : 6174 : calling ToNumber for the fill value for typedarray.prototype.fill",
276+
body: function () {
277+
let arr1 = new Uint32Array(5);
278+
let valueOfCalled = false;
279+
let p1 = new Proxy([], {
280+
get: function(oTarget, sKey) {
281+
if (sKey.toString() == 'valueOf') {
282+
valueOfCalled = true;
283+
}
284+
return Reflect.get(oTarget, sKey);
285+
}
286+
});
287+
Uint32Array.prototype.fill.call(arr1, p1, 5, 1);
288+
assert.isTrue(valueOfCalled);
289+
}
290+
},
274291
{
275292
name: "class name should not change if calling multiple times",
276293
body: function () {

0 commit comments

Comments
 (0)