Bug 187520

Summary:

hasOwnProperty returns true for out of bounds property index on TypedArray

Product:

WebKit

Reporter:

gfablima

Component:

JavaScriptCore

Assignee:

Keith Miller <keith_miller>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

commit-queue, ews-watchlist, fpizlo, isol2, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

Safari 11

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

gfablima

Reported 2018-07-10 08:42:03 PDT

Hi everyone, I found an inconsistence in jsc when we try to get an invalid property in a TypedArray, in this case a Float32Array. Steps to reproduce: var a = new Float32Array([0.1, 0.2, 0.3]); print(Object.getOwnPropertyNames(a).sort()) var c = a.hasOwnProperty(3); if (c) throw new Error("Test failed"); Actual results: 0,1,2 Error: Test failed Expected results: 0,1,2 V8, SpiderMonkey and Chakra works as expected. OS: Ubuntu 16.04 x64 Version: 606.1.9.4

Attachments
Patch (3.68 KB, patch) 2018-07-10 17:46 PDT, Keith Miller	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Keith Miller

Comment 1 2018-07-10 17:33:40 PDT

Thanks for the bug report. Seems like a simple fix.

Keith Miller

Comment 2 2018-07-10 17:46:44 PDT

Created attachment 344738 [details] Patch

WebKit Commit Bot

Comment 3 2018-07-10 18:28:42 PDT

Comment on attachment 344738 [details] Patch Clearing flags on attachment: 344738 Committed r233718: <https://trac.webkit.org/changeset/233718>

WebKit Commit Bot

Comment 4 2018-07-10 18:28:43 PDT

All reviewed patches have been landed. Closing bug.

Radar WebKit Bug Importer

Comment 5 2018-07-10 18:29:49 PDT

<rdar://problem/42051129>

isol2

Comment 6 2018-08-08 09:04:06 PDT

cinfuzz

Note You need to log in before you can comment on or make changes to this bug.