1772858 - Change OOB set for TypedArray target and different receiver

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P3)

Description

[Yulia Startsev [:yulia] OOO until July 2026]

We are currently the odd browser out for typed objects when setting out of bounds. We fall through to OrdinarySet where other browsers exit early. After discussion at tc39, it was decided to use the behavior shared by v8 and JSC

Comment 1

[Jan de Mooij [:jandem]]

(Reading the PR I think this is typed arrays and not typed objects?)

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

See also duplicate bug 1913490

Comment 4

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 1: Update spec references. r=#spidermonkey-reviewers!

Drive-by changes:

• Make SetPropertyByDefining a file static function.
• Remove unused functions SetPropertyOnProto and PropertyResult::setWasmGcProperty.

Comment 5

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 2: Move resolving check to the outer if-statement. r=#spidermonkey-reviewers!

Instead of checking desc_.resolving() repeatedly, move the check into the
outer if-statement.

Drive-by change:

• Remove some unnecessary re-rooting of already rooted variables.

Comment 6

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 3: Sync NativeDefineProperty with current spec. r=#spidermonkey-reviewers!

ValidateAndApplyPropertyDescriptor was refactored in https://github.com/tc39/ecma262/pull/2468,
make sure our implementation follows the current spec text more closely.

But also include the fix from https://github.com/tc39/ecma262/pull/3404.

Comment 7

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 4: Remove AutoResolving::Kind. r=#spidermonkey-reviewers!

We don't use AutoResolving::Kind::WATCH anymore, so we can remove the
whole AutoResolving::Kind enum.

Comment 8

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 5: Don't manually inline SetTypedArrayElement in DefineTypedArrayElement. r=#spidermonkey-reviewers!

It doesn't seem necessary to effectively inline SetTypedArrayElement here.

Comment 9

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 6: Merge SetTypedArrayElement and SetTypedArrayElementOutOfBounds. r=#spidermonkey-reviewers!

SetTypedArrayElement doesn't allow to be called with out-of-bounds indices and
SetTypedArrayElementOutOfBounds must only be called with out-of-bounds indices.
Since we need to rerun the bounds check anyway in TypedArrayObjectTemplate::setElement
after calling convertValue, it doesn't seem useful to have these two separate
functions. And using a single SetTypedArrayElement function which allows out-of-bounds
indices also follows the spec more closely.

Comment 10

[André Bargull [:anba]]

Attachment: Bug 1772858 - Part 7: Don't call OrdinarySet for out-of-bounds typed array elements. r=#spidermonkey-reviewers!

When SetNonexistentProperty is called with out-of-bounds typed array indices, the
spec want us to call SetTypedArrayElement only if the current object pobj is the
receiver.

Two changes are necessary to plumb the relevant information to SetNonexistentProperty:

1. PropertyResult::ignoreProtoChain_ needs an additional bit to track out-of-bounds
   typed array indices. We can store this extra bit efficiently by changing ignoreProtoChain_
   from bool to uint8_t.
2. The current object pobj needs to be passed to SetNonexistentProperty in addition to
   obj and receiver.

There's additional test coverage in test262, but we first need to update test262 again.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8ae7bdf2f383
Part 1: Update spec references. r=spidermonkey-reviewers,jandem
https://hg.mozilla.org/integration/autoland/rev/c24248022ef2
Part 2: Move resolving check to the outer if-statement. r=spidermonkey-reviewers,jandem
https://hg.mozilla.org/integration/autoland/rev/b15419ec07fa
Part 3: Sync NativeDefineProperty with current spec. r=spidermonkey-reviewers,jandem
https://hg.mozilla.org/integration/autoland/rev/1f084420eb9f
Part 4: Remove AutoResolving::Kind. r=spidermonkey-reviewers,jandem
https://hg.mozilla.org/integration/autoland/rev/e5650c79587b
Part 5: Don't manually inline SetTypedArrayElement in DefineTypedArrayElement. r=spidermonkey-reviewers,jandem
https://hg.mozilla.org/integration/autoland/rev/b086d0061631
Part 6: Merge SetTypedArrayElement and SetTypedArrayElementOutOfBounds. r=spidermonkey-reviewers,jandem
https://hg.mozilla.org/integration/autoland/rev/e969f552745a
Part 7: Don't call OrdinarySet for out-of-bounds typed array elements. r=spidermonkey-reviewers,jandem

Comment 12

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/8ae7bdf2f383
https://hg.mozilla.org/mozilla-central/rev/c24248022ef2
https://hg.mozilla.org/mozilla-central/rev/b15419ec07fa
https://hg.mozilla.org/mozilla-central/rev/1f084420eb9f
https://hg.mozilla.org/mozilla-central/rev/e5650c79587b
https://hg.mozilla.org/mozilla-central/rev/b086d0061631
https://hg.mozilla.org/mozilla-central/rev/e969f552745a