28 lines
875 B
JavaScript
28 lines
875 B
JavaScript
|
// Copyright 2018 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
// Tests that creating an iterator that shrinks the array populated by
|
||
|
|
// Array.from does not lead to out of bounds writes.
|
||
|
|
let oobArray = [];
|
||
|
|
let maxSize = 1028 * 8;
|
||
|
|
Array.from.call(function() { return oobArray }, {[Symbol.iterator] : _ => (
|
||
|
|
{
|
||
|
|
counter : 0,
|
||
|
|
next() {
|
||
|
|
let result = this.counter++;
|
||
|
|
if (this.counter > maxSize) {
|
||
|
|
oobArray.length = 0;
|
||
|
|
return {done: true};
|
||
|
|
} else {
|
||
|
|
return {value: result, done: false};
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
) });
|
||
|
|
assertEquals(oobArray.length, maxSize);
|
||
|
|
|
||
|
|
// iterator reset the length to 0 just before returning done, so this will crash
|
||
|
|
// if the backing store was not resized correctly.
|
||
|
|
oobArray[oobArray.length - 1] = 0x41414141;
|