Correct semantics for numerically indexed stores to typed arrays.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 3eedfe92faf08b10e71b512049509a7e197ceb26..b50f78266a1ea15db09286d9a42d19dfe2fcda8f 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2982,6 +2982,22 @@ MaybeHandle<Object> Object::AddDataProperty(LookupIterator* it,
   // instead. If the prototype is Null, the proxy is detached.
   if (receiver->IsJSGlobalProxy()) return value;
 
+  // If the receiver is Indexed Exotic object (currently only typed arrays),
+  // disallow adding properties with numeric names.

[Toon Verwaest, 2014/10/17 09:26:44]

Please put this in a descriptive method or function instead of inlining it here.

[Dmitry Lomov (no reviews), 2014/10/17 09:50:33]

Done.

+  if (receiver->IsJSTypedArray() && it->name()->IsString()) {
+    Handle<String> name_string = Handle<String>::cast(it->name());
+    if (name_string->length() > 0) {
+      double d = StringToDouble(it->isolate()->unicode_cache(), *name_string,
+                                NO_FLAGS);
+      if (!std::isnan(d)) {
+        Factory* factory = it->isolate()->factory();
+        Handle<Object> num = factory->NewNumber(d);
+        Handle<String> roundtrip_string = factory->NumberToString(num);
+        if (String::Equals(name_string, roundtrip_string)) return value;
+      }
+    }
+  }
+
   // Possibly migrate to the most up-to-date map that will be able to store
   // |value| under it->name() with |attributes|.
   it->PrepareTransitionToDataProperty(value, attributes, store_mode);