v8/test/mjsunit/regress/regress-4665.js
cwhan.tunz 9bf2962c14 Reland [typedarrays] Check detached buffer at start of typed array methods
- Throw TypeError in ValidateTypedArray, matching JSC, SpiderMonkey
  and ChakraCore.
- Validate typed arrays at start of each typed array prototype
  methods in src/js/typedarrays.js
- Add tests to check detached buffers
- Remove an unnecessary parameter of TypedArraySpeciesCreate
  in src/js/typedarrays.js
- Standardize TypedArray.prototype.subarray
- Update test262.status to pass detached buffer tests

Reland of https://codereview.chromium.org/2778623003

BUG=v8:4648, v8:4665, v8:4953
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2827443002
Cr-Commit-Position: refs/heads/master@{#44878}
2017-04-26 06:10:17 +00:00

36 lines
867 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// First test case
function FirstBuffer () {}
FirstBuffer.prototype.__proto__ = Uint8Array.prototype
FirstBuffer.__proto__ = Uint8Array
var buf = new Uint8Array(10)
buf.__proto__ = FirstBuffer.prototype
assertThrows(() => buf.subarray(2), TypeError);
// Second test case
let seen_args = [];
function SecondBuffer (arg) {
seen_args.push(arg);
var arr = new Uint8Array(arg)
arr.__proto__ = SecondBuffer.prototype
return arr
}
SecondBuffer.prototype.__proto__ = Uint8Array.prototype
SecondBuffer.__proto__ = Uint8Array
var buf3 = new SecondBuffer(10)
assertEquals([10], seen_args);
var buf4 = buf3.subarray(2)
assertEquals(10, buf4.length);
assertEquals([10, buf3.buffer], seen_args);