diff --git a/bugs/bugs_found.txt b/bugs/bugs_found.txt index bbe170a5a..65e2b7b8c 100644 --- a/bugs/bugs_found.txt +++ b/bugs/bugs_found.txt @@ -1,5 +1,36 @@ +BUG #13 (NEW) + +Date reported: May 02, 2018 + +Type: Test failure + +URLs +JSCore: https://bugs.webkit.org/show_bug.cgi?id=185208 + +Original: +./jsfuzz/seeds/mozilla/non262/TypedArray/constructor-iterable-undefined-or-null.js + +Fuzzed: +./jsfuzz/bugs/fuzzed_files/fuzzed_mozilla_non262_TypedArray_constructor-iterable-undefined-or-null.js + +Patch: + + +pattern: +-------------JavaScriptCore +Error: Type error +-------------Chakra + +-------------SpiderMonkey + +-------------v8 + +Explanation: + +According to GetMethod (object, @@iterator) ES6 specification, if the iterator value is either "undefined" or "null", the method should return "undefined", but JSCore does not support this property as "null". + ====== -BUG #12 (NEW) +BUG #12 Date reported: May 02, 2018 @@ -21,15 +52,18 @@ Pattern: -------------JavaScriptCore Error: expected {"value": 0, "done": false}, got {"done": false, "value": 0} -------------Chakra + -------------SpiderMonkey + -------------v8 + Explanation: According to ES6 specification, the Iterator of a TypedArray.keys() or an Array.keys() should return an object on this order {value: Integer, done: Boolean}. ====== -BUG #11 (CONFIRMED) +BUG #11 (NEW) Date reported: April 30, 2018 @@ -111,7 +145,7 @@ Actual results: Pass without failures ====== -BUG #9 (CONFIRMED) +BUG #9 (NEW) Date reported: April 29, 2018 @@ -144,7 +178,7 @@ Actual result: TypeError: Assertion failed: got "function f() {return "fun-f";}" Expected result: pass without failures ====== -BUG #8 (CONFIRMED) +BUG #8 (NEW) Date reported: April 29, 2018 diff --git a/bugs/fuzzed_files/fuzzed_mozilla_non262_TypedArray_constructor-iterable-undefined-or-null.js b/bugs/fuzzed_files/fuzzed_mozilla_non262_TypedArray_constructor-iterable-undefined-or-null.js new file mode 100644 index 000000000..2d0a0e5b2 --- /dev/null +++ b/bugs/fuzzed_files/fuzzed_mozilla_non262_TypedArray_constructor-iterable-undefined-or-null.js @@ -0,0 +1,22 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 1.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// Construct typed array from object with undefined or null [Symbol.iterator] property. +for (let constructor of anyTypedArrayConstructors) { + for (let iterator of [undefined, null]) { + let arrayLike = { + [Symbol.iterator]: iterator, + length: 2, + 0: 10, + 1: 20, + }; + let typedArray = new constructor(arrayLike); + + assertEq(typedArray.length, arrayLike.length); + assertEqArray(typedArray, arrayLike); + } +} + +if (typeof reportCompare === "function") + reportCompare(true, true);