| Summary: | hasOwnProperty returns true for out of bounds property index on TypedArray | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | gfablima | ||||
| Component: | JavaScriptCore | Assignee: | Keith Miller <keith_miller> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | commit-queue, ews-watchlist, fpizlo, isol2, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | Safari 11 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
Thanks for the bug report. Seems like a simple fix. Created attachment 344738 [details]
Patch
Comment on attachment 344738 [details] Patch Clearing flags on attachment: 344738 Committed r233718: <https://trac.webkit.org/changeset/233718> All reviewed patches have been landed. Closing bug. cinfuzz |
Hi everyone, I found an inconsistence in jsc when we try to get an invalid property in a TypedArray, in this case a Float32Array. Steps to reproduce: var a = new Float32Array([0.1, 0.2, 0.3]); print(Object.getOwnPropertyNames(a).sort()) var c = a.hasOwnProperty(3); if (c) throw new Error("Test failed"); Actual results: 0,1,2 Error: Test failed Expected results: 0,1,2 V8, SpiderMonkey and Chakra works as expected. OS: Ubuntu 16.04 x64 Version: 606.1.9.4