Bug 1001547 - Test for element-setting being careful to bounds-check. r=sfink
authorJeff Walden <jwalden@mit.edu>
Fri, 25 Apr 2014 12:26:11 -0700
changeset 240821 4a11304b51d51643e07fe121f02b146f10437b37
parent 240820 04c3ea2e8d43a016d5fe88f0dca2165ec97c1cad
child 240822 43bdcb0d3c73eaf7d237782a0cedfdbdf13f2433
push id4311
push userraliiev@mozilla.com
push dateMon, 12 Jan 2015 19:37:41 +0000
treeherdermozilla-beta@150c9fed433b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs1001547
milestone36.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1001547 - Test for element-setting being careful to bounds-check. r=sfink
js/src/tests/ecma_6/TypedArray/element-setting-ToNumber-neuters.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/TypedArray/element-setting-ToNumber-neuters.js
@@ -0,0 +1,39 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+"use strict"; // make test fail when limitation below is fixed
+
+var gTestfile = 'element-setting-ToNumber-neuters.js';
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 1001547;
+var summary =
+  "Don't assert assigning into memory neutered while converting the value to " +
+  "assign into a number";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+// Technically per current spec the element-sets should throw in strict mode,
+// but we just silently do nothing for now, somewhat due to limitations of our
+// internal MOP (which can't easily say "try this special behavior, else fall
+// back on normal logic"), somewhat because it's consistent with current
+// behavior (as of this test's addition) for out-of-bounds sets.
+
+var ab1 = new ArrayBuffer(64);
+var ta1 = new Uint32Array(ab1);
+ta1[4] = { valueOf: function() { neuter(ab1, "change-data"); return 5; } };
+
+var ab2 = new ArrayBuffer(64);
+var ta2 = new Uint32Array(ab2);
+ta2[4] = { valueOf: function() { neuter(ab2, "same-data"); return 5; } };
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");