[Webkit-unassigned] [Bug 185127] New: Slicing an ArrayBuffer with a long number returns an ArrayBuffer with byteLength zero

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=185127

            Bug ID: 185127
           Summary: Slicing an ArrayBuffer with a long number returns an
                    ArrayBuffer with byteLength zero
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: abl3 at cin.ufpe.br

Hi there,

There's seems to be an inconsistence when slicing an ArrayBuffer with a long number.

Tag: 606.1.9.4
OS: Ubuntu 16.04 x86_64

Steps to reproduce the problem:
    var a = new ArrayBuffer(5);
    var b = a.slice (3, 4294967297);
    if(b.byteLength !== 0) throw new Error("Test failed");

Expected results: 
Error: Test failed

Actual results:
Pass without failures

The end result is that the test should fail as the slice for range (3, 4294967297) should return the value 2. In JavaScriptCore it returns zero, making the test pass. Other JavaScript engines such as V8, SpiderMonkey and Chakra failed the test as expected.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180430/f1d4541c/attachment.html>