Bug 184749 – Int8Array.prototype sets value to invalid position

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

Hi everyone,

I found a case of inconsistency when try to access an item in invalid position using Int8Array and Uint8Array (same behaviour appears using Int16Array/Uint16Array and Int32Array/Uint32Array).

Tag: 606.1.9.4
OS: ubuntu 16.04 x86

================
Reproduce steps:
- Run this code:
    Int8Array.prototype[10] = 999;
    var a = new Int8Array(5);
    if(!(a[10] === undefined)) throw new Error("Test failed");

Expected results:
pass without errors

Actual results:
Error: Test failed
================

V8, chakra and spidermonkey has passed on this testcase. It was observed that a[10] is 999 (the others engines is undefined), but if we change for "var a = new Int8Array(20)", a[10] is 0 (same occurs with all others engines).

[Radar WebKit Bug Importer]

<rdar://problem/39618641>

cinfuzz

[Ross Kirsling]

This will be fixed as part of bug 217854.

*** This bug has been marked as a duplicate of bug 217854 ***