Skip to content

Fix Object.defineProperty with RAB typed arrays #1067

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

bnoordhuis
Copy link
Contributor

Fix handling inside Object.defineProperty and Object.defineProperties of length-tracking typed arrays whose backing resizable arraybuffers have been shrunk. Check against the actual element count rather than the original element count.

Not an OOB read or write because no memory is accessed, it just didn't throw the expected TypeError exception.

Fix handling inside Object.defineProperty and Object.defineProperties of
length-tracking typed arrays whose backing resizable arraybuffers have
been shrunk. Check against the actual element count rather than the
original element count.

Not an OOB read or write because no memory is accessed, it just didn't
throw the expected TypeError exception.
@bnoordhuis bnoordhuis merged commit d6d0a6d into quickjs-ng:master May 25, 2025
127 checks passed
@bnoordhuis bnoordhuis deleted the fix-object-defineproperty-with-rab-ta branch May 25, 2025 18:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants