Bug 216912

Summary: %TypedArray%.prototype.fill must only evaluate its argument once
Product: WebKit Reporter: Ross Kirsling <ross.kirsling>
Component: New BugsAssignee: Ross Kirsling <ross.kirsling>
Status: RESOLVED FIXED    
Severity: Normal CC: ashvayka, ews-watchlist, joepeck, keith_miller, mark.lam, msaboff, saam, sunlili, tzagallo, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch for landing none

Ross Kirsling
Reported 2020-09-23 21:59:46 PDT
%TypedArray%.prototype.fill must only evaluate its argument once
Attachments
Patch (3.63 KB, patch)
2020-09-23 22:10 PDT, Ross Kirsling 		no flags
DetailsFormatted DiffDiff
Patch for landing (4.13 KB, patch)
2020-09-24 00:13 PDT, Ross Kirsling 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Ross Kirsling
Comment 1 2020-09-23 22:10:27 PDT
Created attachment 409531 [details] Patch
Yusuke Suzuki
Comment 2 2020-09-23 22:30:07 PDT
Comment on attachment 409531 [details] Patch r=me
Alexey Shvayka
Comment 3 2020-09-23 23:51:43 PDT
Comment on attachment 409531 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=409531&action=review > Source/JavaScriptCore/builtins/TypedArrayPrototype.js:94 > + var number = @toNumber(value); According to its ChangeLog, https://webkit.org/b/157088 made the opposite change. Have the spec changed since?
Ross Kirsling
Comment 4 2020-09-24 00:00:22 PDT
(In reply to Alexey Shvayka from comment #3) > Comment on attachment 409531 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=409531&action=review > > > Source/JavaScriptCore/builtins/TypedArrayPrototype.js:94 > > + var number = @toNumber(value); > > According to its ChangeLog, https://webkit.org/b/157088 made the opposite > change. Have the spec changed since? I'm not authorized to see that ticket, but the current spec is clear: https://tc39.es/ecma262/#sec-%typedarray%.prototype.fill (step 5; step 4 is absent because we don't yet support BigInt typed arrays) And we're the only ones to fail the test: https://test262.report/browse/built-ins/TypedArray/prototype/fill/fill-values-conversion-once.js
Ross Kirsling
Comment 5 2020-09-24 00:05:36 PDT
Oh, I see that it's this patch: https://github.com/WebKit/webkit/commit/43383ccbb7d9c88b31d8e330fe3b32705b8305a5 Yeah, it looks like the spec was changed here three years ago: https://github.com/tc39/ecma262/pull/856
Ross Kirsling
Comment 6 2020-09-24 00:13:04 PDT
Created attachment 409536 [details] Patch for landing
EWS
Comment 7 2020-09-24 00:35:34 PDT
Committed r267522: <https://trac.webkit.org/changeset/267522> All reviewed patches have been landed. Closing bug and clearing flags on attachment 409536 [details].
Radar WebKit Bug Importer
Comment 8 2020-09-24 00:36:17 PDT
<rdar://problem/69485929>
Alexey Shvayka
Comment 9 2020-09-24 15:10:05 PDT
*** Bug 199141 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.