Bug 187520 - hasOwnProperty returns true for out of bounds property index on TypedArray
Summary: hasOwnProperty returns true for out of bounds property index on TypedArray
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 11
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-07-10 08:42 PDT by gfablima
Modified: 2018-08-08 09:04 PDT (History)
10 users (show)

See Also:


Attachments
Patch (3.68 KB, patch)
2018-07-10 17:46 PDT, Keith Miller
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description gfablima 2018-07-10 08:42:03 PDT
Hi everyone,
I found an inconsistence in jsc when we try to get an invalid property in a TypedArray, 
in this case a Float32Array.

Steps to reproduce:
var a = new Float32Array([0.1, 0.2, 0.3]);
print(Object.getOwnPropertyNames(a).sort())
var c = a.hasOwnProperty(3);
if (c) throw new Error("Test failed");

Actual results:
0,1,2
Error: Test failed

Expected results:
0,1,2

V8, SpiderMonkey and Chakra works as expected.

OS: Ubuntu 16.04 x64
Version: 606.1.9.4
Comment 1 Keith Miller 2018-07-10 17:33:40 PDT
Thanks for the bug report. Seems like a simple fix.
Comment 2 Keith Miller 2018-07-10 17:46:44 PDT
Created attachment 344738 [details]
Patch
Comment 3 WebKit Commit Bot 2018-07-10 18:28:42 PDT
Comment on attachment 344738 [details]
Patch

Clearing flags on attachment: 344738

Committed r233718: <https://trac.webkit.org/changeset/233718>
Comment 4 WebKit Commit Bot 2018-07-10 18:28:43 PDT
All reviewed patches have been landed.  Closing bug.
Comment 5 Radar WebKit Bug Importer 2018-07-10 18:29:49 PDT
<rdar://problem/42051129>
Comment 6 isol2 2018-08-08 09:04:06 PDT
cinfuzz