Commit 17359d84 authored by Shu-yu Guo's avatar Shu-yu Guo Committed by V8 LUCI CQ

[change-array-by-copy] Allow LO allocation in Array#toSorted

Bug: v8:12764, chromium:1367136
Change-Id: Ia73f507bf480035d883be1bb5189a5b464327d29
Fixed: chromium:1367136
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3916281
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: 's avatarAdam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83403}
parent 0cccb6f2
...@@ -15,7 +15,8 @@ CopyWorkArrayToNewFastJSArray(implicit context: Context, sortState: SortState)( ...@@ -15,7 +15,8 @@ CopyWorkArrayToNewFastJSArray(implicit context: Context, sortState: SortState)(
dcheck(len <= kMaxFastArrayLength); dcheck(len <= kMaxFastArrayLength);
const copy: FixedArray = UnsafeCast<FixedArray>(AllocateFixedArray( const copy: FixedArray = UnsafeCast<FixedArray>(AllocateFixedArray(
elementsKind, Convert<intptr>(len), AllocationFlag::kNone)); elementsKind, Convert<intptr>(len),
AllocationFlag::kAllowLargeObjectAllocation));
const workArray = sortState.workArray; const workArray = sortState.workArray;
CopyElements( CopyElements(
......
...@@ -94,6 +94,12 @@ TestToSortedBasicBehaviorHelper({ length: 4, ...@@ -94,6 +94,12 @@ TestToSortedBasicBehaviorHelper({ length: 4,
assertEquals(0, a.length); assertEquals(0, a.length);
})(); })();
(function TestBig() {
const a = [];
a[50001] = 42.42;
a.toSorted();
})();
(function TestTooBig() { (function TestTooBig() {
const a = { length: Math.pow(2, 32) }; const a = { length: Math.pow(2, 32) };
assertThrows(() => Array.prototype.toSorted.call(a), RangeError); assertThrows(() => Array.prototype.toSorted.call(a), RangeError);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment