187092 2018-06-27 06:05:21 -0700 Inconsistent output compared with other JS engines 2020-06-07 10:01:52 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED WONTFIX P2 Normal --- 1 sunlili webkit-unassigned ashvayka ysuzuki oldest_to_newest 1436924 0 sunlili 2018-06-27 06:05:21 -0700 Hello, The following code behaves strangely (inconsistent with other engines). v1 = new (Float64Array)(); v2 = { valueOf : function () { v3.y = "bar"; return 42; } }; v3 = v1; v3[0] = v2; print(JSON.stringify(v1)); In Safari, output is {"y":"bar"} However, in V8 and Firefox, output is {} BT group 2018.6.27 1441088 1 ysuzuki 2018-07-10 20:44:46 -0700 For the reported issue, I think JSC's behavior is correct. According to https://tc39.github.io/ecma262/#sec-integerindexedelementset, which is invoked by TypedArray's [[Set]], we first perform `ToNumber(value)` at step 3 before checking length. So, v2.valueOf should be executed. And v3.y should be set. Then, I think SpiderMonkey and V8 are wrong for this code. BTW, when looking the code, I've found that JSC does not have length check on [[DefineOwnProperty]] side before performing ToNumber. I'll handle this case. 1660092 2 ashvayka 2020-06-07 10:01:52 -0700 (In reply to sunlili from comment #0) > However, in V8 and Firefox, output is > {} Both Chrome 85 and Firefox 79 output `{"y":"bar"}` now, just like Safari 13.1. test262 coverage: https://test262.report/browse/built-ins/TypedArrayConstructors/internals/Set/tonumber-value-throws.js (last test case).