[Webkit-unassigned] [Bug 171606] getOwnPropertyDescriptor on an indexed property for a typed array is wrong

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=171606

--- Comment #2 from Saam Barati <sbarati at apple.com> ---
(In reply to Saam Barati from comment #1)
> I think the fix is trivial:
> ```
> template<typename Adaptor>
> bool JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot(
>     JSObject* object, ExecState* exec, PropertyName propertyName,
> PropertySlot& slot)
> {
>     JSGenericTypedArrayView* thisObject =
> jsCast<JSGenericTypedArrayView*>(object);
> 
>     if (std::optional<uint32_t> index = parseIndex(propertyName)) {
>         if (thisObject->isNeutered()) {
>             slot.setCustom(thisObject, None,
> throwNeuteredTypedArrayTypeError);
>             return true;
>         }
> 
>         if (thisObject->canGetIndexQuickly(index.value()))
>             slot.setValue(thisObject, DontDelete | ReadOnly,
> thisObject->getIndexQuickly(index.value()));
>         else
>             slot.setValue(thisObject, DontDelete | ReadOnly, jsUndefined());
This part here is also wrong. If the index is >= our length, we don't have the property, and thus, should return false.
>         return true;
>     }
>     
>     return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
> }
> ```
> should not say ReadOnly.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170503/22e6c8ce/attachment.html>