907874 - integer property lookups on typed arrays should never delegate to the prototype

Status: RESOLVED DUPLICATE of bug 695438

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

Our current typed array property access rules don't exactly match the upcoming ES spec in a few edge cases: for a property key P, if SameValue(ToString(ToInteger(P)), P), the lookup must not consult the prototype (it either returns the element if the index is in bounds or 'undefined').  The current behavior instead effectively uses the predicate SameValue(ToString(ToUint32(P)), P) and so deviates if the index is > UINT32_MAX or < 0.  (The proposed behavior makes sense when you consider having typed arrays greater than 4GB.)

For reference, here is typed array [[Get]]:
  http://people.mozilla.org/~jorendorff/es6-draft.html#sec-8.4.6.4
Other access methods are similar.

Comment 1

[Luke Wagner [:luke]]

Also, Odin currently optimizes typed array access with this assumption, so Odin and non-Odin currently behave differently on, e.g., new Int32Array(4)[-1] when Int32Array.prototype[-1] is defined.

Comment 2

[Luke Wagner [:luke]]

Looks like that link went dead, the new spec for typed array get:
  http://people.mozilla.org/~jorendorff/es6-draft.html#sec-integer-indexed-exotic-objects-get-p-receiver