1133377 - DataView constructor handles explicitly undefined parameters wrong

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Matija Tosic]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20150215004021

Steps to reproduce:

var buff = new ArrayBuffer(100);
view = new DataView(buff, undefined, undefined);

At this moment (Feb 16 2015) the bug is also present in the Nightly build.


Actual results:

returns DataView { buffer: ArrayBuffer, byteLength: 0, byteOffset: 0 }

this is a problem because:

function CustomView(buffer, offset, length) {
    this.theView = new DataView(buffer, offset, length);
    // ...
}

so if I use:
var view = new CustomView(buffer);
it gives me an unusable object.


Expected results:

should return DataView { buffer: ArrayBuffer, byteLength: 100, byteOffset: 0 }

Comment 1

[Boris Zbarsky [:bzbarsky]]

Looks to me like DataViewObject::construct is checking args.length() > 2 whereas per spec it should be checking whether args.get(2).isUndefined() is true.

Comment 2

[Jon Coppeard (:jonco)]

Attachment: bug1133377-data-view-constructor

As suggested, check whether argument is undefined.

Comment 3

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8569984 [details] [diff] [review]
bug1133377-data-view-constructor

Review of attachment 8569984 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/TypedArrayObject.cpp
@@ +1061,5 @@
>                                   JSMSG_ARG_INDEX_OUT_OF_RANGE, "1");
>              return false;
>          }
>  
> +        if (args.length() > 2 && !args[2].isUndefined()) {

I'm with bz, I would expect args.get(2).isUndefined()

This is a spec change from the original Khronos draft, I think. I don't think the es-discuss people had even settled on variable arg list handling then. (And typed arrays weren't in ES back then anyway.) I wonder if there are more of these lurking.

Comment 4

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/dc1374ca3034

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/dc1374ca3034