RESOLVED FIXED 187520
hasOwnProperty returns true for out of bounds property index on TypedArray 
https://bugs.webkit.org/show_bug.cgi?id=187520
Summary hasOwnProperty returns true for out of bounds property index on TypedArray
gfablima
Reported 2018-07-10 08:42:03 PDT
Hi everyone, I found an inconsistence in jsc when we try to get an invalid property in a TypedArray, in this case a Float32Array. Steps to reproduce: var a = new Float32Array([0.1, 0.2, 0.3]); print(Object.getOwnPropertyNames(a).sort()) var c = a.hasOwnProperty(3); if (c) throw new Error("Test failed"); Actual results: 0,1,2 Error: Test failed Expected results: 0,1,2 V8, SpiderMonkey and Chakra works as expected. OS: Ubuntu 16.04 x64 Version: 606.1.9.4
Attachments
Patch (3.68 KB, patch)
2018-07-10 17:46 PDT, Keith Miller 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Keith Miller
Comment 1 2018-07-10 17:33:40 PDT
Thanks for the bug report. Seems like a simple fix.
Keith Miller
Comment 2 2018-07-10 17:46:44 PDT
Created attachment 344738 [details] Patch
WebKit Commit Bot
Comment 3 2018-07-10 18:28:42 PDT
Comment on attachment 344738 [details] Patch Clearing flags on attachment: 344738 Committed r233718: <https://trac.webkit.org/changeset/233718>
WebKit Commit Bot
Comment 4 2018-07-10 18:28:43 PDT
All reviewed patches have been landed. Closing bug.
Radar WebKit Bug Importer
Comment 5 2018-07-10 18:29:49 PDT
<rdar://problem/42051129>
isol2
Comment 6 2018-08-08 09:04:06 PDT
cinfuzz
Note You need to log in before you can comment on or make changes to this bug.