22.2.3.22.1 %TypedArray%.prototype.set
Steps 18-22
Maybe change to:
---
Let srcLength be ToLength(Get(src, "length")).
ReturnIfAbrupt(srcLength).
---
for consistency with other %TypedArray% methods which access "length" on an input value.
ToLength would loose the <0 exception in step 22.
However, it does appear that the numerLength != srcLength isn't wanted, so I fixed that
(In reply to Allen Wirfs-Brock from comment #1)
> ToLength would loose the <0 exception in step 22.
Why is it important to handle negative length values in this method? For example when you call `new Int8Array({length: -10})` the negative length is simply clamped to zero.
(In reply to André Bargull from comment #2)
> (In reply to Allen Wirfs-Brock from comment #1)
> > ToLength would loose the <0 exception in step 22.
>
> Why is it important to handle negative length values in this method? For
> example when you call `new Int8Array({length: -10})` the negative length is
> simply clamped to zero.
Here's what I get in FF:
new Int8Array({length: -10});
/*
Exception: size and count too large
@Scratchpad/1:1:2
*/
which suggests it is doing a ToUint32 conversion on length
If it really is interop crazy land out there WRT these things, maybe we can consistently use the ToLength conversion
(In reply to Allen Wirfs-Brock from comment #3)
> If it really is interop crazy land out there WRT these things, maybe we can
> consistently use the ToLength conversion
JavaScriptCore and SpiderMonkey use ToUint32:
https://github.com/WebKit/webkit/blob/d8a2db3a06fee9ea133698eaad030f3a9d7b2cb2/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeInlines.h#L59
https://dxr.mozilla.org/mozilla-central/source/js/src/vm/TypedArrayCommon.h#695-697
V8 uses... err nothing?
https://github.com/v8/v8-git-mirror/blob/64a2717529e2197f3a789adabf86ca36f5eb764c/src/typedarray.js#L275-L288
https://github.com/v8/v8-git-mirror/blob/64a2717529e2197f3a789adabf86ca36f5eb764c/src/typedarray.js#L190-L201
From the v8 shell:
d8> new Int8Array(10).set({length: {valueOf: function(){ print("aah"); return 5; }}})
aah
aah
aah
aah
aah
aah
aah
in rev34 editor's draft
switched to ToLength.
fixed in rev34