1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
// Out-of-bounds accesses are detected when inlining DataView.
function testRead() {
const xs = [0x11_22_33_44, 0x55_66_77_88];
let dv = new DataView(new ArrayBuffer(Int32Array.BYTES_PER_ELEMENT * 2));
dv.setInt32(0 * Int32Array.BYTES_PER_ELEMENT, xs[0], true);
dv.setInt32(1 * Int32Array.BYTES_PER_ELEMENT, xs[1], true);
function f(dv, q) {
for (let i = 0; i <= 1000; ++i) {
// Perform an out-of-bounds read in the last iteration.
let k = (i & 1) * Int32Array.BYTES_PER_ELEMENT + (i === 1000 && q == 2 ? 7 : 0);
let v = dv.getInt32(k, true);
assertEq(v, xs[i & 1]);
}
}
try {
for (var i = 0; i <= 2; ++i) {
f(dv, i);
}
} catch (e) {
assertEq(e instanceof RangeError, true, e.message);
assertEq(i, 2);
}
}
testRead();
function testWrite() {
const xs = [0x11_22_33_44, 0x55_66_77_88];
let dv = new DataView(new ArrayBuffer(Int32Array.BYTES_PER_ELEMENT * 2));
let ui8 = new Uint8Array(dv.buffer);
function f(dv, q) {
for (let i = 0; i <= 1000; ++i) {
// Perform an out-of-bounds read in the last iteration.
let k = (i & 1) * Int32Array.BYTES_PER_ELEMENT + (i === 1000 && q == 2 ? 7 : 0);
let x = xs[i & 1];
dv.setInt32(k, x);
assertEq(ui8[0 + (i & 1) * Int32Array.BYTES_PER_ELEMENT], (x >> 24) & 0xff);
assertEq(ui8[1 + (i & 1) * Int32Array.BYTES_PER_ELEMENT], (x >> 16) & 0xff);
assertEq(ui8[2 + (i & 1) * Int32Array.BYTES_PER_ELEMENT], (x >> 8) & 0xff);
assertEq(ui8[3 + (i & 1) * Int32Array.BYTES_PER_ELEMENT], (x >> 0) & 0xff);
}
}
try {
for (var i = 0; i <= 2; ++i) {
f(dv, i);
}
} catch (e) {
assertEq(e instanceof RangeError, true, e.message);
assertEq(i, 2);
}
}
testWrite();
|
