RESOLVED FIXED 71975
DFG byte array support sometimes clamps values incorrectly 
https://bugs.webkit.org/show_bug.cgi?id=71975
Summary DFG byte array support sometimes clamps values incorrectly
Filip Pizlo
Reported 2011-11-09 17:33:30 PST
The jump that tests if the value is too big isn't linked, so we end up setting the value to zero instead of 255.
Attachments
the patch (1.84 KB, patch)
2011-11-09 17:39 PST, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
the patch (32.77 KB, patch)
2011-11-10 16:58 PST, Filip Pizlo 		oliver: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-11-09 17:33:59 PST
<rdar://problem/10423888>
Filip Pizlo
Comment 2 2011-11-09 17:39:13 PST
Created attachment 114404 [details] the patch Not quite sure how to test this since I've not used byte arrays… Oliver?
Oliver Hunt
Comment 3 2011-11-10 16:09:35 PST
(In reply to comment #2) > Created an attachment (id=114404) [details] > the patch > > Not quite sure how to test this since I've not used byte arrays… Oliver? theoretically canvas = document.createElement("canvas") context = canvas.getContext("2d") imageData = context.createImageData(10,10); data = imageData.data; // data is a byte array
Filip Pizlo
Comment 4 2011-11-10 16:58:46 PST
Created attachment 114605 [details] the patch Added test.
Filip Pizlo
Comment 5 2011-11-10 17:08:13 PST
Landed in http://trac.webkit.org/changeset/99917
Note You need to log in before you can comment on or make changes to this bug.