Bug 1001547 - Test for element-setting being careful to bounds-check. r=sfink
authorJeff Walden <jwalden@mit.edu>
Fri, 25 Apr 2014 12:26:11 -0700
changeset 216507 4a11304b51d51643e07fe121f02b146f10437b37
parent 216506 04c3ea2e8d43a016d5fe88f0dca2165ec97c1cad
child 216508 43bdcb0d3c73eaf7d237782a0cedfdbdf13f2433
push idunknown
push userunknown
push dateunknown
reviewerssfink
bugs1001547
milestone36.0a1
Bug 1001547 - Test for element-setting being careful to bounds-check. r=sfink
js/src/tests/ecma_6/TypedArray/element-setting-ToNumber-neuters.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/element-setting-ToNumber-neuters.js
@@ -0,0 +1,39 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+"use strict"; // make test fail when limitation below is fixed
+
+var gTestfile = 'element-setting-ToNumber-neuters.js';
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 1001547;
+var summary =
+  "Don't assert assigning into memory neutered while converting the value to " +
+  "assign into a number";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+// Technically per current spec the element-sets should throw in strict mode,
+// but we just silently do nothing for now, somewhat due to limitations of our
+// internal MOP (which can't easily say "try this special behavior, else fall
+// back on normal logic"), somewhat because it's consistent with current
+// behavior (as of this test's addition) for out-of-bounds sets.
+
+var ab1 = new ArrayBuffer(64);
+var ta1 = new Uint32Array(ab1);
+ta1[4] = { valueOf: function() { neuter(ab1, "change-data"); return 5; } };
+
+var ab2 = new ArrayBuffer(64);
+var ta2 = new Uint32Array(ab2);
+ta2[4] = { valueOf: function() { neuter(ab2, "same-data"); return 5; } };
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");