Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 44 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/reduceRight/callbackfn-detachbuffer.js b/js/src/tests/test262/built-ins/TypedArray/prototype/reduceRight/callbackfn-detachbuffer.js
new file mode 100644
index 0000000000..48cc0be33c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/reduceRight/callbackfn-detachbuffer.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.reduceright
+description: >
+  Instance buffer can be detached during loop
+info: |
+  22.2.3.21 %TypedArray%.prototype.reduceRight ( callbackfn [ , initialValue ] )
+
+  %TypedArray%.prototype.reduceRight is a distinct function that implements the
+  same algorithm as Array.prototype.reduceRight as defined in 22.1.3.20 except
+  that the this object's [[ArrayLength]] internal slot is accessed in place of
+  performing a [[Get]] of "length".
+
+  22.1.3.20 Array.prototype.reduceRight ( callbackfn [ , initialValue ] )
+
+  ...
+  8. Repeat, while k < len
+    ...
+    c. If kPresent is true, then
+      ...
+      i. Let accumulator be ? Call(callbackfn, undefined, « accumulator, kValue,
+      k, O »).
+  ...
+includes: [detachArrayBuffer.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var loops = 0;
+  var sample = new TA(2);
+
+  sample.reduceRight(function() {
+    if (loops === 0) {
+      $DETACHBUFFER(sample.buffer);
+    }
+    loops++;
+    return true;
+  }, 0);
+
+  assert.sameValue(loops, 2);
+});
+
+reportCompare(0, 0);