Summary: | TypedArray.prototype.set is incorrect with primitives | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | NWU_NISL <nisl_grammarly1> | ||||||
Component: | JavaScriptCore | Assignee: | Alexey Shvayka <ashvayka> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Minor | CC: | ashvayka, darin, ews-watchlist, fpizlo, isol2, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer, ysuzuki | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | All | ||||||||
OS: | All | ||||||||
Attachments: |
|
Description
NWU_NISL
2020-06-03 23:01:03 PDT
In genericTypedArrayViewProtoFuncSet(), JSC casts an argument to JSObject* instead of performing toObject(). SpiderMonkey gets this right, while V8 handles all primitives per spec except for numbers. I will submit a patch as soon as test262 coverage (https://github.com/tc39/test262/pull/2651) is merged & synced. *** Bug 188877 has been marked as a duplicate of this bug. *** Created attachment 402161 [details]
Patch
Comment on attachment 402161 [details]
Patch
r=me
Created attachment 402198 [details]
Patch
Adjust WebGL tests.
Committed r263216: <https://trac.webkit.org/changeset/263216> All reviewed patches have been landed. Closing bug and clearing flags on attachment 402198 [details]. |