624483 - JM: different output with testcase involving typed arrays, "Infinity"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

This script:
---
var arr = new Uint8ClampedArray(16);
for (var i = 0; i < 16; i++) {
    arr[i] = "Infinity";
}
assertEq(arr[14], 255);
---
Fails with -m: 
Error: Assertion failed: got 0, expected 255

Comment 1

[Boris Zbarsky [:bzbarsky]]

Jan, does this fail with non-infinite numbers larger than 255 too?  Issues in Uint8ClampedArray in particular worry me compat-wise, since that's pretty widely used on the web (as canvas imagedata's .data property).

Comment 2

[Jan de Mooij [:jandem]]

(In reply to comment #1)
> Jan, does this fail with non-infinite numbers larger than 255 too? 

It fails also with "1e12" and "1e15", but not "1e14" and "1e16". And only if they are strings. I tried some random numbers between 255 and 1000 but was unable to reproduce.

Comment 3

[Jan de Mooij [:jandem]]

FWIW, "2147483648" also fails. I think integers are OK, maybe some smaller doubles also fail, not sure.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

I investigated this to see if it was sg:critical, it's not but the bug is pretty easy.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Does that patch make ClampIntForUint8Array unused?

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Nope, it's still there.

Comment 7

[David Anderson [:dvander] - inactive, e-mail if emergency]

vlad: review ping

Comment 8

[David Anderson [:dvander] - inactive, e-mail if emergency]

Thanks! http://hg.mozilla.org/tracemonkey/rev/7fcc58bfd920

Comment 9

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/7fcc58bfd920