v8/test/mjsunit/regress/regress-crbug-915783.js
peterwmwong 682db7845c [typedarray] Add TA.p.toLocaleString check for a detached buffer.
Bug: chromium:915783
Change-Id: I053ee6e905a98e0aafcabcf0838ada836a05c181
Reviewed-on: https://chromium-review.googlesource.com/c/1382553
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#58327}
2018-12-18 15:06:15 +00:00

36 lines
972 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
const constructors = [
[Uint8Array, [0, 1]],
[Int8Array, [0, 1]],
[Uint16Array, [0, 1]],
[Int16Array, [0, 1]],
[Uint32Array, [0, 1]],
[Int32Array, [0, 1]],
[Float32Array, [0, 1]],
[Float64Array, [0, 1]],
[Uint8ClampedArray, [0, 1]],
[BigInt64Array, [0n, 1n]],
[BigUint64Array, [0n, 1n]]
];
let typedArray;
function detachBuffer() {
%ArrayBufferDetach(typedArray.buffer);
return 'a';
}
Number.prototype.toString = detachBuffer;
BigInt.prototype.toString = detachBuffer;
Number.prototype.toLocaleString = detachBuffer;
BigInt.prototype.toLocaleString = detachBuffer;
constructors.forEach(([constructor, arr]) => {
typedArray = new constructor(arr);
assertSame(typedArray.join(), '0,1');
assertSame(typedArray.toLocaleString(), 'a,');
});