Bug 212730 - TypedArray.prototype.set is incorrect with primitives
Summary: TypedArray.prototype.set is incorrect with primitives
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Minor
Assignee: Alexey Shvayka
Keywords: InRadar
: 188877 (view as bug list)
Depends on:
Reported: 2020-06-03 23:01 PDT by NWU_NISL
Modified: 2020-06-18 10:10 PDT (History)
12 users (show)

See Also:

Patch (3.96 KB, patch)
2020-06-17 15:38 PDT, Alexey Shvayka
no flags Details | Formatted Diff | Diff
Patch (11.52 KB, patch)
2020-06-18 04:02 PDT, Alexey Shvayka
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description NWU_NISL 2020-06-03 23:01:03 PDT
#version: dbae081

var NISLFuzzingFunc = function(){
	var e = '123';
	A = new Uint8Array(5);

./webkit/WebKitBuild/Release/bin/jsc testcase.js

Exception: TypeError: First argument should be an object

#Expected output:


According to ES2019 standard, the steps of `%TypedArray%.prototype.set` are as follows.

> %TypedArray%.prototype.set ( array [ , offset ] )
> 1. Assert: array is any ECMAScript language value other than an Object with a [[TypedArrayName]] internal slot. If it is such an Object, the definition in applies.
>    ...
> 15. Let src be ? ToObject(array).

In this testcase, `ToObject(e)` should not throw a TypeError. So I suspect it is a bug of javascriptcore.


#Additional info:
Contributor: QuXing
Comment 1 Radar WebKit Bug Importer 2020-06-07 14:04:29 PDT
Comment 2 Alexey Shvayka 2020-06-08 08:40:55 PDT
In genericTypedArrayViewProtoFuncSet(), JSC casts an argument to JSObject* instead of performing toObject().
SpiderMonkey gets this right, while V8 handles all primitives per spec except for numbers.
I will submit a patch as soon as test262 coverage (https://github.com/tc39/test262/pull/2651) is merged & synced.
Comment 3 Alexey Shvayka 2020-06-08 08:41:43 PDT
*** Bug 188877 has been marked as a duplicate of this bug. ***
Comment 4 Alexey Shvayka 2020-06-17 15:38:39 PDT
Created attachment 402161 [details]
Comment 5 Yusuke Suzuki 2020-06-17 15:45:06 PDT
Comment on attachment 402161 [details]

Comment 6 Alexey Shvayka 2020-06-18 04:02:24 PDT
Created attachment 402198 [details]

Adjust WebGL tests.
Comment 7 EWS 2020-06-18 10:10:35 PDT
Committed r263216: <https://trac.webkit.org/changeset/263216>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 402198 [details].