Bug 1001547 - Fix a bug in typed array element-setting. r=sfink

js/src/jsobj.cpp

@@ -4991,7 +4991,12 @@ baseops::SetPropertyHelper(typename ExecutionModeTraits<mode>::ContextType cxArg
                     return false;
             }
 
-            TypedArrayObject::setElement(obj->as<TypedArrayObject>(), index, d);
+            // Silently do nothing for out-of-bounds sets, for consistency with
+            // current behavior.  (ES6 currently says to throw for this in
+            // strict mode code, so we may eventually need to change.)
+            TypedArrayObject &tarray = obj->as<TypedArrayObject>();
+            if (index < tarray.length())
+                TypedArrayObject::setElement(tarray, index, d);
             return true;
         }
 

js/src/vm/TypedArrayObject.cpp

@@ -1978,6 +1978,8 @@ TypedArrayObject::getElement(uint32_t index)
 void
 TypedArrayObject::setElement(TypedArrayObject &obj, uint32_t index, double d)
 {
+    MOZ_ASSERT(index < obj.length());
+
     switch (obj.type()) {
       case ScalarTypeDescr::TYPE_INT8:
         TypedArrayObjectTemplate<int8_t>::setIndexValue(obj, index, d);