blob: 0692e72247e5bb8e2d39f1b59803b72d94e48295 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
// Copyright (C) 2019 Google. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-array.prototype.copywithin
description: >
SECURITY: start argument is coerced to an integer value
and side effects change the length of the array so that
the start is out of bounds
info: |
22.1.3.3 Array.prototype.copyWithin (target, start [ , end ] )
...
8. Let relativeStart be ToInteger(start).
...
includes: [compareArray.js]
---*/
// make a long integer Array
function longDenseArray(){
var a = [0];
for(var i = 0; i < 1024; i++){
a[i] = i;
}
return a;
}
function shorten(){
currArray.length = 20;
return 1000;
}
var array = [];
array.length = 20;
var currArray = longDenseArray();
assert.compareArray(
currArray.copyWithin(0, {valueOf: shorten}), array,
'currArray.copyWithin(0, {valueOf: shorten}) returns array'
);
currArray = longDenseArray();
Object.setPrototypeOf(currArray, longDenseArray());
var array2 = longDenseArray();
array2.length = 20;
for(var i = 0; i < 24; i++){
array2[i] = Object.getPrototypeOf(currArray)[i+1000];
}
assert.compareArray(
currArray.copyWithin(0, {valueOf: shorten}), array2,
'currArray.copyWithin(0, {valueOf: shorten}) returns array2'
);
reportCompare(0, 0);
|
