From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 02:47:55 +0200 Subject: Adding upstream version 124.0.1. Signed-off-by: Daniel Baumann --- .../element-setting-ToNumber-detaches.js | 35 ++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 js/src/tests/non262/extensions/element-setting-ToNumber-detaches.js (limited to 'js/src/tests/non262/extensions/element-setting-ToNumber-detaches.js') diff --git a/js/src/tests/non262/extensions/element-setting-ToNumber-detaches.js b/js/src/tests/non262/extensions/element-setting-ToNumber-detaches.js new file mode 100644 index 0000000000..0d4b6f9c33 --- /dev/null +++ b/js/src/tests/non262/extensions/element-setting-ToNumber-detaches.js @@ -0,0 +1,35 @@ +/* + * Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/licenses/publicdomain/ + */ +"use strict"; // make test fail when limitation below is fixed + +var gTestfile = 'element-setting-ToNumber-detaches.js'; +//----------------------------------------------------------------------------- +var BUGNUMBER = 1001547; +var summary = + "Don't assert assigning into memory detached while converting the value to " + + "assign into a number"; + +print(BUGNUMBER + ": " + summary); + +/************** + * BEGIN TEST * + **************/ + +// Technically per current spec the element-sets should throw in strict mode, +// but we just silently do nothing for now, somewhat due to limitations of our +// internal MOP (which can't easily say "try this special behavior, else fall +// back on normal logic"), somewhat because it's consistent with current +// behavior (as of this test's addition) for out-of-bounds sets. + +var ab = new ArrayBuffer(64); +var ta = new Uint32Array(ab); +ta[4] = { valueOf() { detachArrayBuffer(ab); return 5; } }; + +/******************************************************************************/ + +if (typeof reportCompare === "function") + reportCompare(true, true); + +print("Tests complete"); -- cgit v1.2.3