Bug 991981 - Test for DataView.prototype.set* with neutering during arguments parsing. r=sfink
authorJeff Walden <jwalden@mit.edu>
Mon, 21 Apr 2014 14:05:40 -0700
changeset 210065 84db6506625e65d2bbd8b10f267b10b0166313f1
parent 210064 b4c32d72735f23784bec6f544c8a5d1937fc92e6
child 210066 a91412e045d946f0835a73db9f1c84ef1c6273f2
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewerssfink
bugs991981
milestone35.0a1
Bug 991981 - Test for DataView.prototype.set* with neutering during arguments parsing. r=sfink
js/src/tests/ecma_6/DataView/browser.js
js/src/tests/ecma_6/DataView/shell.js
js/src/tests/ecma_6/extensions/DataView-set-arguments-neutering.js
new file mode 100644
new file mode 100644
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/extensions/DataView-set-arguments-neutering.js
@@ -0,0 +1,87 @@
+// |reftest| skip-if(!xulRuntime.shell) -- needs neuter()
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var gTestfile = "DataView-set-arguments-neutering.js";
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 991981;
+var summary =
+  "DataView.prototype.set* methods shouldn't misbehave horribly if " +
+  "index-argument conversion neuters the ArrayBuffer being modified";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function testIndex(dataType)
+{
+  var ab = new ArrayBuffer(0x1000);
+
+  var dv = new DataView(ab);
+
+  var start =
+    {
+      valueOf: function()
+      {
+        neuter(ab, dataType);
+        gc();
+        return 0xFFF;
+      }
+    };
+
+  var ok = false;
+  try
+  {
+    dv.setUint8(start, 0x42);
+  }
+  catch (e)
+  {
+    ok = true;
+  }
+  assertEq(ok, true, "should have thrown");
+  assertEq(ab.byteLength, 0, "should have been neutered correctly");
+}
+testIndex("change-data");
+testIndex("same-data");
+
+function testValue(dataType)
+{
+  var ab = new ArrayBuffer(0x100000);
+
+  var dv = new DataView(ab);
+
+  var value =
+    {
+      valueOf: function()
+      {
+        neuter(ab, dataType);
+        gc();
+        return 0x42;
+      }
+    };
+
+  var ok = false;
+  try
+  {
+    dv.setUint8(0xFFFFF, value);
+  }
+  catch (e)
+  {
+    ok = true;
+  }
+  assertEq(ok, true, "should have thrown");
+  assertEq(ab.byteLength, 0, "should have been neutered correctly");
+}
+testValue("change-data");
+testValue("same-data");
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");