RESOLVED FIXED304899
[JSC] Fix Value Conversion in `%TypedArray%.prototype.set` that Shrinks and then Grows `ArrayBuffer` for ECMA-262 Alignment 
https://bugs.webkit.org/show_bug.cgi?id=304899
Summary [JSC] Fix Value Conversion in `%TypedArray%.prototype.set` that Shrinks and t...
Keita Nonaka
Reported 2026-01-04 00:07:37 PST
Fix value conversion in `%TypedArray%.prototype.set` that shrinks and then grows `ArrayBuffer` for ECMA-262 alignment. - https://tc39.es/ecma262/#sec-%typedarray%.prototype.set - https://tc39.es/ecma262/#sec-settypedarrayfromarraylike
Attachments
Add attachment proposed patch, testcase, etc.
Keita Nonaka
Comment 1 2026-01-04 00:09:43 PST
Pull request: https://github.com/WebKit/WebKit/pull/56052
Radar WebKit Bug Importer
Comment 2 2026-01-11 00:08:12 PST
<rdar://problem/167928620>
EWS
Comment 3 2026-02-01 00:25:23 PST
Committed 306594@main (841a8a56e8cd): <https://commits.webkit.org/306594@main> Reviewed commits have been landed. Closing PR #56052 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.