diff --git a/src/builtins/typed-array-sort.tq b/src/builtins/typed-array-sort.tq index 868af426b5dd..37760ccb5c15 100644 --- a/src/builtins/typed-array-sort.tq +++ b/src/builtins/typed-array-sort.tq @@ -15,25 +15,10 @@ transitioning macro CallCompare( // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)). const v: Number = ToNumber_Inline(Call(context, comparefn, Undefined, a, b)); - // b. If IsDetachedBuffer(buffer) is true, throw a TypeError exception. - // c. Let getBufferByteLength be - // MakeIdempotentArrayBufferByteLengthGetter(SeqCst). - // d. If IsIntegerIndexedObjectOutOfBounds(obj, getBufferByteLength) is true, - // throw a TypeError exception. - // TODO(v8:11111): Update this, depending on how - // https://github.com/tc39/ecma262/pull/2646#issuecomment-1067456576 gets - // resolved. - try { - LoadJSTypedArrayLengthAndCheckDetached(array) - otherwise DetachedOrOutOfBounds; - } label DetachedOrOutOfBounds { - ThrowTypeError(MessageTemplate::kDetachedOperation, kBuiltinNameSort); - } - - // e. If v is NaN, return +0. + // b. If v is NaN, return +0. if (NumberIsNaN(v)) return 0; - // f. return v. + // c. return v. return v; } @@ -149,17 +134,17 @@ transitioning javascript builtin TypedArrayPrototypeSort( TypedArrayMergeSort(work2, 0, len, work1, array, comparefn); - // Reload the length; it's possible the backing ArrayBuffer has been resized. - // It cannot be OOB here though, since we've checked it as part of the - // comparison function. - - // TODO(v8:11111): Update this, depending on how - // https://github.com/tc39/ecma262/pull/2646#issuecomment-1067456576 gets - // resolved. - const newLen = - LoadJSTypedArrayLengthAndCheckDetached(array) otherwise unreachable; - if (newLen < len) { - len = newLen; + // Reload the length; it's possible the backing ArrayBuffer has been resized + // to be OOB or detached, in which case treat it as length 0. + + try { + const newLen = LoadJSTypedArrayLengthAndCheckDetached(array) + otherwise DetachedOrOutOfBounds; + if (newLen < len) { + len = newLen; + } + } label DetachedOrOutOfBounds { + len = 0; } // work1 contains the sorted numbers. Write them back. diff --git a/test/mjsunit/typedarray-resizablearraybuffer-detach.js b/test/mjsunit/typedarray-resizablearraybuffer-detach.js index b701b153524a..7d626b7c646f 100644 --- a/test/mjsunit/typedarray-resizablearraybuffer-detach.js +++ b/test/mjsunit/typedarray-resizablearraybuffer-detach.js @@ -1458,6 +1458,12 @@ d8.file.execute('test/mjsunit/typedarray-helpers.js'); return 0; } + function AssertIsDetached(ta) { + assertEquals(0, ta.byteLength); + assertEquals(0, ta.byteOffset); + assertEquals(0, ta.length); + } + // Fixed length TA. for (let ctor of ctors) { rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, @@ -1466,7 +1472,8 @@ d8.file.execute('test/mjsunit/typedarray-helpers.js'); const taFull = new ctor(rab, 0); WriteUnsortedData(taFull); - assertThrows(() => { fixedLength.sort(CustomComparison); }); + fixedLength.sort(CustomComparison); + AssertIsDetached(fixedLength); } // Length-tracking TA. @@ -1477,7 +1484,8 @@ d8.file.execute('test/mjsunit/typedarray-helpers.js'); const taFull = new ctor(rab, 0); WriteUnsortedData(taFull); - assertThrows(() => { lengthTracking.sort(CustomComparison); }); + lengthTracking.sort(CustomComparison); + AssertIsDetached(lengthTracking); } })(); diff --git a/test/mjsunit/typedarray-resizablearraybuffer.js b/test/mjsunit/typedarray-resizablearraybuffer.js index 6fd5df8a5a2a..60c49d16a0c8 100644 --- a/test/mjsunit/typedarray-resizablearraybuffer.js +++ b/test/mjsunit/typedarray-resizablearraybuffer.js @@ -6597,7 +6597,7 @@ function TestIterationAndResize(ta, expected, rab, resize_after, const taFull = new ctor(rab, 0); WriteUnsortedData(taFull); - assertThrows(() => { fixedLength.sort(CustomComparison); }); + fixedLength.sort(CustomComparison); // The data is unchanged. assertEquals([10, 9], ToNumbers(taFull)); diff --git a/test/test262/test262.status b/test/test262/test262.status index 0666771f05ae..59a32d17925d 100644 --- a/test/test262/test262.status +++ b/test/test262/test262.status @@ -2907,7 +2907,6 @@ # https://bugs.chromium.org/p/v8/issues/detail?id=12750 'built-ins/TypedArray/prototype/set/array-arg-targetbuffer-detached-on-get-src-value-no-throw': [FAIL], - 'built-ins/TypedArray/prototype/sort/sort-tonumber': [FAIL], ######################## NEEDS INVESTIGATION ###########################