Bug 71975

Summary:

DFG byte array support sometimes clamps values incorrectly

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

eric, oliver

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+
the patch	oliver: review+

Filip Pizlo

Reported 2011-11-09 17:33:30 PST

The jump that tests if the value is too big isn't linked, so we end up setting the value to zero instead of 255.

Attachments
the patch (1.84 KB, patch) 2011-11-09 17:39 PST, Filip Pizlo	oliver: review+	Details Formatted Diff Diff
the patch (32.77 KB, patch) 2011-11-10 16:58 PST, Filip Pizlo	oliver: review+	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2011-11-09 17:33:59 PST

<rdar://problem/10423888>

Filip Pizlo

Comment 2 2011-11-09 17:39:13 PST

Created attachment 114404 [details] the patch Not quite sure how to test this since I've not used byte arrays… Oliver?

Oliver Hunt

Comment 3 2011-11-10 16:09:35 PST

(In reply to comment #2) > Created an attachment (id=114404) [details] > the patch > > Not quite sure how to test this since I've not used byte arrays… Oliver? theoretically canvas = document.createElement("canvas") context = canvas.getContext("2d") imageData = context.createImageData(10,10); data = imageData.data; // data is a byte array

Filip Pizlo

Comment 4 2011-11-10 16:58:46 PST

Created attachment 114605 [details] the patch Added test.

Filip Pizlo

Comment 5 2011-11-10 17:08:13 PST

Landed in http://trac.webkit.org/changeset/99917

Eric Seidel (no email)

Comment 6 2011-12-02 13:06:58 PST

This test appears to be flaky on lion: http://build.webkit.org/old-results/Lion%20Intel%20Release%20(Tests)/r99919%20(2597)/fast/js/dfg-byte-array-put-pretty-diff.html

Note You need to log in before you can comment on or make changes to this bug.