v8/test/mjsunit/regress/regress-crbug-917980.js
peterwmwong 75ca843c5c [typedarray] Check for a detached buffer before each iteration of TypedArray.p.join.
Bug: chromium:917980
Change-Id: Ia9b68f492bb9f0769dc6ee1706baf8b09de49968
Reviewed-on: https://chromium-review.googlesource.com/c/1392070
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58490}
2018-12-31 18:27:51 +00:00

34 lines
769 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
const constructors = [
[Uint8Array, [0, 1]],
[Int8Array, [0, 1]],
[Uint16Array, [0, 1]],
[Int16Array, [0, 1]],
[Uint32Array, [0, 1]],
[Int32Array, [0, 1]],
[Float32Array, [0, 1]],
[Float64Array, [0, 1]],
[Uint8ClampedArray, [0, 1]],
[BigInt64Array, [0n, 1n]],
[BigUint64Array, [0n, 1n]]
];
let typedArray;
const separator = {
toString() {
%ArrayBufferDetach(typedArray.buffer);
return '*';
}
};
constructors.forEach(([constructor, arr]) => {
typedArray = new constructor(arr);
assertSame(typedArray.join(separator), '*');
});