Bug 83818 – Incorrect TypedArray#set behavior

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Stéphan Kochen]

Created attachment 136964 [details]
Test case

Copying between two TypedArrays of different types, but backed by the same ArrayBuffer, using TypedArray#set can lead to incorrect results.

The attached test case can be run straight in the Developer Tools console. It contains three asserts of which the third fails:

    Uint16 value: 1285 == 1285 ? true
    First Uint16 element: 5 == 5 ? true
    Second Uint16 element: 0 == 5 ? false

I'm guessing a[0] is written before b[1] is read. According to the spec, the copy should behave as if a temporary buffer is inbetween.

Tested on a nightly, that describes itself as: Version 5.1.5 (7534.55.3, r113983)

Thread on WebGL mailing list: https://www.khronos.org/webgl/public-mailing-list/archives/1204/msg00172.html

[Oliver Hunt]

Yay for a spec that claims performance is important, but actively sabotages optimisations.

[Kenneth Russell]

As discussed on the public_webgl list, the original intent of the typed array spec was that this would throw TypeError. set() taking a typed array was supposed to be implementable using memmove().

Unfortunately, it turns out that this overload was illegal according to Web IDL. Recent Web IDL spec changes make the overload legal, but require that the version taking a JS array be called for all typed array view types other than the receiver's.

[Filip Pizlo]

I'll look at it.

[Filip Pizlo]

Created attachment 209432 [details]
the patch

Note, I have a bunch of tests for this - I'll upload the ad-hoc tests I wrote and I will LayoutTest-ify them later.  I plan to also LayoutTest-ify Stéphan's original test case.

[Filip Pizlo]

Created attachment 209433 [details]
test for the case where we optimize with memmove

[Filip Pizlo]

Created attachment 209434 [details]
test for overlapping elements of the same size

[Filip Pizlo]

Created attachment 209435 [details]
test where the source elements are smaller than the destination elements

[Filip Pizlo]

Created attachment 209436 [details]
test where the destination elements are smaller than the source elements

[Filip Pizlo]

Created attachment 209501 [details]
the patch

The patch including tests and some minor changes.

[Mark Hahnenberg]

Comment on attachment 209501 [details]
the patch

r=me too

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/154518