[Webkit-unassigned] [Bug 184749] New: Int8Array.prototype sets value to invalid position

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184749

            Bug ID: 184749
           Summary: Int8Array.prototype sets value to invalid position
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: isol2 at cin.ufpe.br

Hi everyone,

I found a case of inconsistency when try to access an item in invalid position using Int8Array and Uint8Array (same behaviour appears using Int16Array/Uint16Array and Int32Array/Uint32Array).

Tag: 606.1.9.4
OS: ubuntu 16.04 x86

================
Reproduce steps:
- Run this code:
    Int8Array.prototype[10] = 999;
    var a = new Int8Array(5);
    if(!(a[10] === undefined)) throw new Error("Test failed");

Expected results:
pass without errors

Actual results:
Error: Test failed
================

V8, chakra and spidermonkey has passed on this testcase. It was observed that a[10] is 999 (the others engines is undefined), but if we change for "var a = new Int8Array(20)", a[10] is 0 (same occurs with all others engines).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180418/845637e9/attachment.html>