[Webkit-unassigned] [Bug 184232] New: Typed array constructor behaves differently when length is not passed or when undefined is passed

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184232

            Bug ID: 184232
           Summary: Typed array constructor behaves differently when
                    length is not passed or when undefined is passed
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: koby.b at mce.systems

Hi
I've noticed that when I create a typed array, the resulting array's byteLength is different if I'm not passing a length, or if I'm passing an undefined length:
const buffer = new ArrayBuffer(8);
const view1 = new Uint8Array(buffer); // byteLength == 8
const view2 = new Uint8Array(buffer, undefined, undefined); // byteLength == 0

Tested with the JSC shell from my WebKit fork, forked on github on February, and with Safari on iOS 11.2.6.

According to to the ecma standard (https://www.ecma-international.org/ecma-262/6.0/#sec-%typedarray%-buffer-byteoffset-length) I think they should produce typed arrays with the same byteLength.
I've verified it with Firefox nightly and Chrome nightly (both on Windows), both producing a Uint8Array with the same byteLength(8).

Going through JSC's source, I think the issue is in constructGenericTypedArrayView in runtime/JSGenericTypedArrayViewConstructorInlines.h. It handles undefined byteLength for DataViews, but not the "length" for other typed arrays.

Thanks,
Koby

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180402/5af99838/attachment-0002.html>