1913490 - Typed array [[Set]] assigns to the receiver when an invalid canonical numeric string is passed as property name

Status: RESOLVED DUPLICATE of bug 1772858

(Core :: JavaScript Engine, defect)

Description

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Spec: https://github.com/tc39/ecma262/pull/1556

1. If P is a String, then
    a. Let numericIndex be CanonicalNumericIndexString(P).
    b. If numericIndex is not undefined, then
        i. If SameValue(O, Receiver) is true, then
            1. Perform ? TypedArraySetElement(O, numericIndex, V).
            2. Return true.
        ii. If IsValidIntegerIndex(O, numericIndex) is false, return true.
2. Return ? OrdinarySet(O, P, V, Receiver).

Consider the following example where P = numericIndex = 1.5, O != Receiver. Then 1.a.ii will call IsValidIntegerIndex, which returns false (step 2, 1.5 is not an integral Number) and the OrdinarySet call is not reached.

var ta = new Uint8Array([0]);
var receiver = {};
Reflect.set(ta, 1.5, 42, receiver);
receiver; // { 1.5: 42 }, should be {}

Note that fixing this will make non262/TypedArray/set-with-receiver.js fail.

More tests in https://github.com/tc39/test262/pull/4200

Comment 1

[André Bargull [:anba]]

This sounds like bug 1772858?