diff options
Diffstat (limited to 'js/src/tests/test262/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js')
-rw-r--r-- | js/src/tests/test262/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js b/js/src/tests/test262/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js new file mode 100644 index 0000000000..cefe3e64a4 --- /dev/null +++ b/js/src/tests/test262/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js @@ -0,0 +1,46 @@ +// Copyright (C) 2019 Google. All rights reserved. +// This code is governed by the BSD license found in the LICENSE file. +/*--- +esid: sec-array.prototype.copywithin +description: > + SECURITY: start argument is coerced to an integer value + and side effects change the length of the array so that + the target is out of bounds +info: | + 22.1.3.3 Array.prototype.copyWithin (target, start [ , end ] ) + + ... + 8. Let relativeStart be ToInteger(start). + ... +includes: [compareArray.js] +---*/ + + +// make a long integer Array +function longDenseArray(){ + var a = [0]; + for(var i = 0; i < 1024; i++){ + a[i] = i; + } + return a; +} + +function shorten(){ + currArray.length = 20; + return 1; +} + +var array = longDenseArray(); +array.length = 20; +for(var i = 0; i < 19; i++){ + array[i+1000] = array[i+1]; +} + +var currArray = longDenseArray(); + +assert.compareArray( + currArray.copyWithin(1000, {valueOf: shorten}), array, + 'currArray.copyWithin(1000, {valueOf: shorten}) returns array' +); + +reportCompare(0, 0); |