summaryrefslogtreecommitdiffstats
path: root/js/src/tests/test262/built-ins/DataView/custom-proto-access-detaches-buffer.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/tests/test262/built-ins/DataView/custom-proto-access-detaches-buffer.js')
-rw-r--r--js/src/tests/test262/built-ins/DataView/custom-proto-access-detaches-buffer.js38
1 files changed, 38 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/DataView/custom-proto-access-detaches-buffer.js b/js/src/tests/test262/built-ins/DataView/custom-proto-access-detaches-buffer.js
new file mode 100644
index 0000000000..cbd0628a9f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/DataView/custom-proto-access-detaches-buffer.js
@@ -0,0 +1,38 @@
+// Copyright (C) 2018 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+author: Jeff Walden <jwalden+code@mit.edu>
+esid: sec-dataview-buffer-byteoffset-bytelength
+description: >
+ The `DataView` constructor shouldn't be able to return a `DataView` instance
+ backed by a detached `ArrayBuffer` when `OrdinaryCreateFromConstructor`
+ returns an instance so backed.
+info: |
+ `OrdinaryCreateFromConstructor` has the potential to invoke user-defined code
+ that may detach the `ArrayBuffer` intended to underlie the fresh instance.
+ Verify that a final is-detached check is performed before the new instance is
+ returned.
+includes: [detachArrayBuffer.js]
+features: [Reflect.construct]
+---*/
+
+var buffer = new ArrayBuffer(8);
+
+var called = false;
+var byteOffset = { valueOf() { called = true; return 0; } };
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+ get() {
+ $DETACHBUFFER(buffer);
+ return DataView.prototype;
+ }
+});
+
+assert.throws(TypeError, function() {
+ Reflect.construct(DataView, [buffer, byteOffset], newTarget);
+});
+assert.sameValue(called, true);
+
+reportCompare(0, 0);