[Webkit-unassigned] [Bug 159385] ECMAScript 2016: %TypedArray%.prototype.includes implementation

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159385

Benjamin Poulain <benjamin at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |benjamin at webkit.org

--- Comment #16 from Benjamin Poulain <benjamin at webkit.org> ---
> > > Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:222
> > > +        if (array[index] == target)
> > 
> > Isn't that missing the NaN case?
> 
> Now I am considering it. However I have a doubt with suspicious cases:
> 
> 1. If the searchElement is an Object or a String? In IntXArray, they are
> converted to 0, so "new UInt8Array([0, 1, 2]).includes("abc"); // is true".
> It is not just the case of %TypedArray%.prototype.includes, but also
> %TypedArray%.prototype.indexOf. I didn't find any information about it in
> the Spec. I checked v8 implementation and they return false to these cases.
> IMHO, I think it is the best result, since "new UInt8Array([0, 1,
> 2]).includes("abc");" returning "true" is a potential unpredictable bug
> source.

You are right, 
    new UInt8Array([0, 1, 2]).includes("abc")
and
    new UInt8Array([0, 1, 2]).indexOf("abc")
should return false. Converting the string to a number makes no sense.

The spec does not say to convert the input to a number:
-https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.indexof
-https://tc39.github.io/ecma262/#sec-array.prototype.indexof

You have discovered a really stupid bug in the existing indexOf!

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160704/f9ec8ece/attachment.html>