Bug 985733 - Make assignments into typed arrays use ToNumber-style semantics. r=sfink, r=jandem

2014-03-20 16:38:12 -07:00
parent 9c4b670f89
commit d86f0ca99b
5 changed files with 91 additions and 124 deletions
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5030,11 +5030,13 @@ baseops::SetPropertyHelper(typename ExecutionModeTraits<mode>::ContextType cxArg
                // conversions.
                if (vp.isObject())
                    return false;
+                if (!NonObjectToNumber(cxArg, vp, &d))
+                    return false;
+            } else {
+                if (!ToNumber(cxArg->asJSContext(), vp, &d))
+                    return false;
            }

-            if (!ToDoubleForTypedArray(cxArg, vp, &d))
-                return false;
-
            TypedArrayObject::setElement(obj->as<TypedArrayObject>(), index, d);
            return true;
        }