855659 - TypedArrays should not use [[Prototype]] for out-of-bounds indices

Status: RESOLVED DUPLICATE of bug 829896

(Core :: JavaScript Engine, defect)

Description

[André Bargull [:anba]]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130307023931

Steps to reproduce:

Access to out-of-bounds indices on TypedArrays should not trigger prototype-chain search. This is currently specified in the latest ES6 draft at [15.13.6.6.10] TypedArray.prototype.@@elementGet. Obviously asm.js code does the right thing already. 

Related test cases:
tests/basic/testTypedArrayOutOfBounds.js
tests/basic/typed-array-getprop-out-of-range.js

test case:
---
// define getter on Object.prototype
Object.defineProperty(Object.prototype, "1024", {get: function(){print("getter"); return 0}})

// this code will execute the getter
new Int32Array(new ArrayBuffer(4096))[4096>>2]

// now as a asm.js module
function MyASM(std,fe,heap){
  "use asm";
  var a = new std.Int32Array(heap);
  function get(){ return a[4096>>2]|0 }
  return {get: get}
}
m = MyASM(this, {}, new ArrayBuffer(4096))
// this code will _not_ execute the getter
m.get()
---