Bug 188792
| Summary: | Accessing negative index element of a TypedArray object should return undefined | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | sunlili |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Normal | CC: | ashvayka, fpizlo, ysuzuki |
| Priority: | P2 | ||
| Version: | WebKit Local Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=184749 | ||
sunlili
Executing following code :
-----------------------------------------------
var arr = new Float64Array(100);
function foo()
{
for (var k = 0; k > -10; k--) {
arr[k] %= 5.1 * k
}
}
function bar()
{
for (var k = 0; k > -10; k--) {
print(arr[k]);
}
}
foo();
bar();
print("BT_FLAG");
------------------------------------------------
The output should be:
NaN
undefined
undefined
undefined
undefined
undefined
undefined
undefined
undefined
undefined
BT_FLAG
However, output of JavaScriptCore is :
NaN
NaN
NaN
NaN
NaN
NaN
NaN
NaN
NaN
NaN
BT_FLAG
BT_GROUP
2018/8/21
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Alexey Shvayka
r244950 fixed TypedArray internal methods with non-canonical numeric keys, including negative indices.
test262 coverage: https://test262.report/browse/built-ins/TypedArrayConstructors/internals/Set/key-is-out-of-bounds.js.
*** This bug has been marked as a duplicate of bug 197228 ***