fix possible multiple call of ToBigInt / ToNumber conversion of t…

…he argument passed to `%TypedArray%.prototype.fill` in V8 ~ Chrome < 59, Safari < 14.1, FF < 55, Edge <=18
zloirock · May 31, 2022 · 6f9bf9e · 6f9bf9e
1 parent c04e4e1
commit 6f9bf9e
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 7 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,7 +1,7 @@
 ## Changelog
 ##### Unreleased
 - Changed the order of operations in `%TypedArray%.prototype.with` following [proposal-change-array-by-copy/86](https://github.com/tc39/proposal-change-array-by-copy/issues/86)
-- Fixed possible multiple call of `ToBigInt` / `ToNumber` conversion of the argument passed to `%TypedArray%.prototype.fill` polyfill
+- Fixed possible multiple call of `ToBigInt` / `ToNumber` conversion of the argument passed to `%TypedArray%.prototype.fill` in V8 ~ Chrome < 59, Safari < 14.1, FF < 55, Edge <=18
 - Fixed the kind of error (`TypeError` instead of `Error`) on incorrect `exec` result in `RegExp.prototype.test` polyfill
 - Fixed dependencies of `{ actual, full, features }/typed-array/at` entries
 - Added Electron 20.0 compat data mapping

diff --git a/packages/core-js-compat/src/data.mjs b/packages/core-js-compat/src/data.mjs
@@ -1398,10 +1398,9 @@ export const data = {
     safari: '10.0',
   },
   'es.typed-array.fill': {
-    chrome: '45',
-    edge: '13',
-    firefox: '37',
-    safari: '10.0',
+    chrome: '58',
+    firefox: '55',
+    safari: '14.1',
   },
   'es.typed-array.filter': {
     chrome: '45',

diff --git a/packages/core-js/modules/es.typed-array.fill.js b/packages/core-js/modules/es.typed-array.fill.js
@@ -5,16 +5,25 @@ var toBigInt = require('../internals/to-big-int');
 var classof = require('../internals/classof');
 var call = require('../internals/function-call');
 var uncurryThis = require('../internals/function-uncurry-this');
+var fails = require('../internals/fails');
 
 var aTypedArray = ArrayBufferViewCore.aTypedArray;
 var exportTypedArrayMethod = ArrayBufferViewCore.exportTypedArrayMethod;
 var slice = uncurryThis(''.slice);
 
+// V8 ~ Chrome < 59, Safari < 14.1, FF < 55, Edge <=18
+var CONVERSION_BUG = fails(function () {
+  var count = 0;
+  // eslint-disable-next-line es-x/no-typed-arrays -- safe
+  new Int8Array(2).fill({ valueOf: function () { return count++; } });
+  return count !== 1;
+});
+
 // `%TypedArray%.prototype.fill` method
 // https://tc39.es/ecma262/#sec-%typedarray%.prototype.fill
 exportTypedArrayMethod('fill', function fill(value /* , start, end */) {
   var length = arguments.length;
   aTypedArray(this);
   var actualValue = slice(classof(this), 0, 3) === 'Big' ? toBigInt(value) : +value;
   return call($fill, this, actualValue, length > 1 ? arguments[1] : undefined, length > 2 ? arguments[2] : undefined);
-});
+}, CONVERSION_BUG);
diff --git a/tests/compat/tests.js b/tests/compat/tests.js
@@ -1167,7 +1167,9 @@ GLOBAL.tests = {
     return Int8Array.prototype.every;
   }],
   'es.typed-array.fill': [ARRAY_BUFFER_VIEWS_SUPPORT, function () {
-    return Int8Array.prototype.fill;
+    var count = 0;
+    new Int8Array(2).fill({ valueOf: function () { return count++; } });
+    return count === 1;
   }],
   'es.typed-array.filter': [ARRAY_BUFFER_VIEWS_SUPPORT, function () {
     return Int8Array.prototype.filter;