js/src/jit-test/tests/sharedbuf/resized-out-of-bounds-to-in-bounds-index-over-mailbox.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

// |jit-test| --enable-arraybuffer-resizable; skip-if: !this.SharedArrayBuffer?.prototype?.grow||helperThreadCount()===0

let gsab = new SharedArrayBuffer(3, {maxByteLength: 4});

setSharedObject(gsab);

function worker(gsab) {
  let ta = new Int8Array(gsab);

  // Wait until `valueOf` is called.
  while (Atomics.load(ta, 0) === 0);

  // Now grow the buffer.
  gsab.grow(4);

  // Notify the buffer has been resized.
  Atomics.store(ta, 1, 1);
}

evalInWorker(`(${worker})(getSharedObject());`);

let ta = new Int8Array(gsab);

let value = {
  valueOf() {
    // Notify we're in `valueOf()`.
    Atomics.store(ta, 0, 1);

    // Wait until buffer has been resized.
    while (Atomics.load(ta, 1) === 0);

    // Continue execution.
    return 0;
  }
};

// Write into currently out-of-bounds, but later in-bounds index.
ta[3] = value;