Bug 184749
| Summary: | Int8Array.prototype sets value to invalid position | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | isol2 |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | benjamin, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, rmorisset, ross.kirsling, saam, ticaiolima, tzagallo, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Safari 11 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: |
https://bugs.webkit.org/show_bug.cgi?id=188792 https://bugs.webkit.org/show_bug.cgi?id=217854 |
||
isol2
Hi everyone,
I found a case of inconsistency when try to access an item in invalid position using Int8Array and Uint8Array (same behaviour appears using Int16Array/Uint16Array and Int32Array/Uint32Array).
Tag: 606.1.9.4
OS: ubuntu 16.04 x86
================
Reproduce steps:
- Run this code:
Int8Array.prototype[10] = 999;
var a = new Int8Array(5);
if(!(a[10] === undefined)) throw new Error("Test failed");
Expected results:
pass without errors
Actual results:
Error: Test failed
================
V8, chakra and spidermonkey has passed on this testcase. It was observed that a[10] is 999 (the others engines is undefined), but if we change for "var a = new Int8Array(20)", a[10] is 0 (same occurs with all others engines).
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/39618641>
isol2
cinfuzz
Ross Kirsling
This will be fixed as part of bug 217854.
*** This bug has been marked as a duplicate of bug 217854 ***