chakra-core / chakra-core/ChakraCore

Incorrect realization of SetItem() functions

Open
#3,187 10 comments 0 reactions 0 assignees View on GitHub
Bug Severity: 2
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Hello,
The following code behaves incorrectly (inconsistent with the standard and other engines) in Chakra due to incorrect realization of SetItems() functions:

```
var y = 0;
var t = [1,2,3];

var mp = new Proxy([], {
get: function (oTarget, sKey) {
print("get " + sKey.toString());
y = y + 1;
print("y = " + y);
if(y == 2){
var temp = [];
t.length = 20;
for (var i=0; i<20; i++)
t[i] = 0x10;
return 5;
}
if(y > 2) {
return oTarget[sKey];
}
return oTarget[sKey] || undefined;
//return oTarget[sKey] || oTarget.getItem(sKey) || undefined;
},
set: function (oTarget, sKey, vValue) {
print("set " + sKey);
if (sKey in oTarget) { return false; }
return oTarget[sKey] = vValue;
},

});

function f(a){
print(a);
}

t.length = 4;
t.__proto__ = mp;

f(...t);
```

the 't[i] = 0x10;' in get() should call set() when i is undefined, however, in Chakra, t[i] is assigned directly.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.