Bug 188792

Summary: Accessing negative index element of a TypedArray object should return undefined
Product: WebKit Reporter: sunlili
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ashvayka, fpizlo, ysuzuki
Priority: P2    
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=184749

Description sunlili 2018-08-21 06:03:07 PDT
Executing following code :
-----------------------------------------------
var arr = new Float64Array(100);

function foo()
{
  for (var k = 0; k > -10; k--) {
    arr[k] %= 5.1 * k
  }
}

function bar()
{
    for (var k = 0; k > -10; k--) {
        print(arr[k]);
    }
}

foo();
bar();
print("BT_FLAG");
------------------------------------------------

The output should be:
NaN
undefined
undefined
undefined
undefined
undefined
undefined
undefined
undefined
undefined
BT_FLAG

However, output of JavaScriptCore is :
NaN
NaN
NaN
NaN
NaN
NaN
NaN
NaN
NaN
NaN
BT_FLAG

BT_GROUP
2018/8/21
Comment 1 Alexey Shvayka 2020-06-07 07:17:13 PDT
r244950 fixed TypedArray internal methods with non-canonical numeric keys, including negative indices.
test262 coverage: https://test262.report/browse/built-ins/TypedArrayConstructors/internals/Set/key-is-out-of-bounds.js.

*** This bug has been marked as a duplicate of bug 197228 ***