Closed
Bug 855659
Opened 11 years ago
Closed 11 years ago
TypedArrays should not use [[Prototype]] for out-of-bounds indices
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 829896
People
(Reporter: anba, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0 Build ID: 20130307023931 Steps to reproduce: Access to out-of-bounds indices on TypedArrays should not trigger prototype-chain search. This is currently specified in the latest ES6 draft at [15.13.6.6.10] TypedArray.prototype.@@elementGet. Obviously asm.js code does the right thing already. Related test cases: tests/basic/testTypedArrayOutOfBounds.js tests/basic/typed-array-getprop-out-of-range.js test case: --- // define getter on Object.prototype Object.defineProperty(Object.prototype, "1024", {get: function(){print("getter"); return 0}}) // this code will execute the getter new Int32Array(new ArrayBuffer(4096))[4096>>2] // now as a asm.js module function MyASM(std,fe,heap){ "use asm"; var a = new std.Int32Array(heap); function get(){ return a[4096>>2]|0 } return {get: get} } m = MyASM(this, {}, new ArrayBuffer(4096)) // this code will _not_ execute the getter m.get() ---
Updated•11 years ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•