Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 841a8a56e8cdbc1404d2972b3031f5bb620c340c
https://github.com/WebKit/WebKit/commit/841a8a56e8cdbc1404d2972b3031f5bb620c340c
Author: Keita Nonaka <[email protected]>
Date: 2026-02-01 (Sun, 01 Feb 2026)
Changed paths:
A JSTests/stress/typedarray-set-resize.js
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
Log Message:
-----------
[JSC] Fix Value Conversion in `%TypedArray%.prototype.set` that Shrinks and
then Grows `ArrayBuffer` for ECMA-262 Alignment
https://bugs.webkit.org/show_bug.cgi?id=304899
Reviewed by Keith Miller.
Previously, the for loops had early returns
which do not align with ECMA-262 behavior.
This patch fixes value conversion in `%TypedArray%.prototype.set`
that shrinks and then grows `ArrayBuffer` for ECMA-262 alignment[1][2].
[1]: https://tc39.es/ecma262/#sec-%typedarray%.prototype.set
[2]: https://tc39.es/ecma262/#sec-settypedarrayfromarraylike
Test: JSTests/stress/typedarray-set-resize.js
* JSTests/stress/typedarray-set-resize.js: Added.
(shouldBe):
(grow.valueOf):
(shrink.valueOf):
(array.get length):
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::setFromArrayLike):
Canonical link: https://commits.webkit.org/306594@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
