184749 2018-04-18 12:55:48 -0700 Int8Array.prototype sets value to invalid position 2020-10-16 16:20:15 -0700 1 1 1 Unclassified WebKit JavaScriptCore Safari 11 Unspecified Unspecified RESOLVED DUPLICATE 217854 https://bugs.webkit.org/show_bug.cgi?id=188792 https://bugs.webkit.org/show_bug.cgi?id=217854 InRadar P2 Normal --- 1 isol2 webkit-unassigned benjamin fpizlo ggaren gskachkov keith_miller mark.lam msaboff rmorisset ross.kirsling saam ticaiolima tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1415657 0 isol2 2018-04-18 12:55:48 -0700 Hi everyone, I found a case of inconsistency when try to access an item in invalid position using Int8Array and Uint8Array (same behaviour appears using Int16Array/Uint16Array and Int32Array/Uint32Array). Tag: 606.1.9.4 OS: ubuntu 16.04 x86 ================ Reproduce steps: - Run this code: Int8Array.prototype[10] = 999; var a = new Int8Array(5); if(!(a[10] === undefined)) throw new Error("Test failed"); Expected results: pass without errors Actual results: Error: Test failed ================ V8, chakra and spidermonkey has passed on this testcase. It was observed that a[10] is 999 (the others engines is undefined), but if we change for "var a = new Int8Array(20)", a[10] is 0 (same occurs with all others engines). 1416651 1 webkit-bug-importer 2018-04-20 23:43:12 -0700 <rdar://problem/39618641> 1453358 2 isol2 2018-08-23 18:02:02 -0700 cinfuzz 1698815 3 ross.kirsling 2020-10-16 16:20:15 -0700 This will be fixed as part of bug 217854. *** This bug has been marked as a duplicate of bug 217854 ***