1216621 - Missing receiver checks for [[Get]] and [[Set]] on typed array

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

Test case for [[Get]]:
---
Object.prototype[1] = "inherited";
assertEq(Reflect.get(new Int8Array([10]), 0), 10);
assertEq(Reflect.get(new Int8Array([10]), 1), undefined);
assertEq(Reflect.get(new Int8Array([10]), 0, {}), 10);
assertEq(Reflect.get(new Int8Array([10]), 1, {}), "inherited");
---

Expected: No error thrown
Actual: Error thrown 'Assertion failed: got (void 0), expected "inherited"'



Test case for [[Set]]:
---
Object.defineProperty(Object.prototype, 1, {set(v){ this.result = v }, configurable: true});
var obj = {}, ta = new Int8Array([10]);
assertEq(Reflect.set(ta, 1, 20, obj), true);
assertEq(obj.result, 20);
---

Expected: No error thrown
Actual: Error thrown 'Assertion failed: got (void 0), expected 20"'



Spec:
ES2015 9.4.5.4 [[Get]] and 9.4.5.5 [[Set]] check SameValue(O, Receiver) and only if that test passes all integer indexed accesses go directly to the typed array. A similar check is probably required in LookupOwnPropertyInline [1] (LookupOwnPropertyInline is called by NativeGetPropertyInline and NativeSetProperty)?


[1] https://dxr.mozilla.org/mozilla-central/rev/9605da94e75d61598d3c00f01a12d1b6bc427a6c/js/src/vm/NativeObject-inl.h#450

Comment 1

[Tom S [:evilpie]]

https://github.com/tc39/ecma262/commit/a5af3a626160db63bda2cfd1e797269c3394e905