Bug 991981 - Test for typedArray.set(arraylike, offset) not asserting when arraylike.length neuters typedArray. r=sfink
authorJeff Walden <jwalden@mit.edu>
Wed, 14 May 2014 11:59:19 -0700
changeset 234605 08018668136ea90fd1c126641849cb9c1878288b
parent 234604 541ca516d9ca5ff59e7f710e7d110947a6f005ce
child 234606 be9320beb260c8ad584f88b99c57cb35a6241380
push id611
push userraliiev@mozilla.com
push dateMon, 05 Jan 2015 23:23:16 +0000
treeherdermozilla-release@345cd3b9c445 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs991981
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 991981 - Test for typedArray.set(arraylike, offset) not asserting when arraylike.length neuters typedArray. r=sfink
js/src/tests/ecma_6/extensions/TypedArray-set-object-funky-length-neuters.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/extensions/TypedArray-set-object-funky-length-neuters.js
@@ -0,0 +1,67 @@
+// |reftest| skip-if(!xulRuntime.shell) -- needs neuter()
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var gTestfile = "set-object-funky-length-neuters.js";
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 991981;
+var summary =
+  "%TypedArray.set(object with funky length property, numeric offset) " +
+  "shouldn't misbehave if the funky length property neuters this typed array";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var ctors = [Int8Array, Uint8Array, Uint8ClampedArray,
+             Int16Array, Uint16Array,
+             Int32Array, Uint32Array,
+             Float32Array, Float64Array];
+ctors.forEach(function(TypedArray) {
+  ["change-data", "same-data"].forEach(function(dataHandling) {
+    var buf = new ArrayBuffer(512 * 1024);
+    var ta = new TypedArray(buf);
+
+    var arraylike =
+      {
+        0: 17,
+        1: 42,
+        2: 3,
+        3: 99,
+        4: 37,
+        5: 9,
+        6: 72,
+        7: 31,
+        8: 22,
+        9: 0,
+        get length()
+        {
+          neuter(buf, dataHandling);
+          return 10;
+        }
+      };
+
+      var passed = false;
+      try
+      {
+        ta.set(arraylike, 0x1234);
+      }
+      catch (e)
+      {
+        passed = true;
+      }
+
+      assertEq(passed, true);
+  });
+});
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");