Andreas Kling be5320b67c LibJS: Evaluate ToNumber for out-of-bounds typed array writes ... The interpreter's fast path for PutByValue on a typed array treated an out-of-bounds index as a silent no-op and returned without touching the value. That is observably wrong: TypedArraySetElement evaluates ToNumber(value) before checking the index, so a value with a valueOf side effect must still have that side effect run even when the store is ultimately discarded. Fall back to the slow path on an out-of-bounds or otherwise invalid index instead of reporting success. The slow path runs the full TypedArraySetElement algorithm, which performs the coercion and then discards the write. Direct assignment now matches Reflect.set, which already went through the slow path. Fixes the staging/sm typed array out-of-bounds ToNumber test262 case and adds a test-js regression covering direct assignment, Reflect.set, and Reflect.defineProperty.		2026-06-17 21:24:33 +02:00
..
asmint.asm	LibJS: Call AsmInt directly from run_executable	2026-06-14 20:27:59 +02:00
AsmSlowPaths.cpp	LibJS: Evaluate ToNumber for out-of-bounds typed array writes	2026-06-17 21:24:33 +02:00
gen_asm_offsets.cpp	LibJS: Move final simple opcodes into AsmInt	2026-06-14 20:27:59 +02:00