From 75311854543abcf6ca0b4b0ce306a8832d6ac470 Mon Sep 17 00:00:00 2001
From: Alexey Shvayka <shvaikalesh@gmail.com>
Date: Thu, 25 Feb 2021 03:17:13 +0200
Subject: [PATCH] Normative: Guard IntegerIndexedElementSet with receiver check

---
 spec.html | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/spec.html b/spec.html
index 50399a6a83b..2dc640e67dd 100644
--- a/spec.html
+++ b/spec.html
@@ -11780,8 +11780,10 @@ <h1>[[Set]] ( _P_, _V_, _Receiver_ )</h1>
           1. If Type(_P_) is String, then
             1. Let _numericIndex_ be ! CanonicalNumericIndexString(_P_).
             1. If _numericIndex_ is not *undefined*, then
-              1. Perform ? IntegerIndexedElementSet(_O_, _numericIndex_, _V_).
-              1. Return *true*.
+              1. If ! IsValidIntegerIndex(_O_, _numericIndex_) is *false*, return *true*.
+              1. If ! SameValue(_O_, _Receiver_) is *true*, then
+                1. Perform ? IntegerIndexedElementSet(_O_, _numericIndex_, _V_).
+                1. Return *true*.
           1. Return ? OrdinarySet(_O_, _P_, _V_, _Receiver_).
         </emu-alg>
       </emu-clause>
@@ -11868,15 +11870,15 @@ <h1>IntegerIndexedElementSet ( _O_, _index_, _value_ )</h1>
         <p>The abstract operation IntegerIndexedElementSet takes arguments _O_, _index_ (a Number), and _value_. It performs the following steps when called:</p>
         <emu-alg>
           1. Assert: _O_ is an Integer-Indexed exotic object.
+          1. Assert: ! IsValidIntegerIndex(_O_, _index_) is *true*.
           1. If _O_.[[ContentType]] is ~BigInt~, let _numValue_ be ? ToBigInt(_value_).
           1. Otherwise, let _numValue_ be ? ToNumber(_value_).
-          1. If ! IsValidIntegerIndex(_O_, _index_) is *true*, then
-            1. Let _offset_ be _O_.[[ByteOffset]].
-            1. Let _arrayTypeName_ be the String value of _O_.[[TypedArrayName]].
-            1. Let _elementSize_ be the Element Size value specified in <emu-xref href="#table-the-typedarray-constructors"></emu-xref> for _arrayTypeName_.
-            1. Let _indexedPosition_ be (ℝ(_index_) &times; _elementSize_) + _offset_.
-            1. Let _elementType_ be the Element Type value in <emu-xref href="#table-the-typedarray-constructors"></emu-xref> for _arrayTypeName_.
-            1. Perform SetValueInBuffer(_O_.[[ViewedArrayBuffer]], _indexedPosition_, _elementType_, _numValue_, *true*, ~Unordered~).
+          1. Let _offset_ be _O_.[[ByteOffset]].
+          1. Let _arrayTypeName_ be the String value of _O_.[[TypedArrayName]].
+          1. Let _elementSize_ be the Element Size value specified in <emu-xref href="#table-the-typedarray-constructors"></emu-xref> for _arrayTypeName_.
+          1. Let _indexedPosition_ be (ℝ(_index_) &times; _elementSize_) + _offset_.
+          1. Let _elementType_ be the Element Type value in <emu-xref href="#table-the-typedarray-constructors"></emu-xref> for _arrayTypeName_.
+          1. Perform SetValueInBuffer(_O_.[[ViewedArrayBuffer]], _indexedPosition_, _elementType_, _numValue_, *true*, ~Unordered~).
           1. Return NormalCompletion(*undefined*).
         </emu-alg>
         <emu-note>