Bug 71975 - DFG byte array support sometimes clamps values incorrectly
Summary: DFG byte array support sometimes clamps values incorrectly
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2011-11-09 17:33 PST by Filip Pizlo
Modified: 2011-12-02 13:06 PST (History)
2 users (show)

See Also:

Attachments
the patch (1.84 KB, patch)
2011-11-09 17:39 PST, Filip Pizlo 		oliver: review+
Details | Formatted Diff | Diff
the patch (32.77 KB, patch)
2011-11-10 16:58 PST, Filip Pizlo 		oliver: review+
Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-11-09 17:33:30 PST 
The jump that tests if the value is too big isn't linked, so we end up setting the value to zero instead of 255.
Comment 1 Filip Pizlo 2011-11-09 17:33:59 PST 
<rdar://problem/10423888>
Comment 2 Filip Pizlo 2011-11-09 17:39:13 PST 
Created attachment 114404 [details]
the patch

Not quite sure how to test this since I've not used byte arrays…  Oliver?
Comment 3 Oliver Hunt 2011-11-10 16:09:35 PST 
(In reply to comment #2)
> Created an attachment (id=114404) [details]
> the patch
> 
> Not quite sure how to test this since I've not used byte arrays…  Oliver?

theoretically
canvas = document.createElement("canvas")
context = canvas.getContext("2d")
imageData = context.createImageData(10,10);
data = imageData.data; // data is a byte array
Comment 4 Filip Pizlo 2011-11-10 16:58:46 PST 
Created attachment 114605 [details]
the patch

Added test.
Comment 5 Filip Pizlo 2011-11-10 17:08:13 PST 
Landed in http://trac.webkit.org/changeset/99917