summaryrefslogtreecommitdiffstats
path: root/js/src/tests/test262/built-ins/DataView/prototype/setFloat32/range-check-after-value-conversion.js
blob: b1b40bca43cbd784f9796430d17ecb0555f4216f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
// Copyright (C) 2015 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.

/*---
esid: sec-dataview.prototype.setfloat32
description: >
  Index bounds checks are performed after value conversion.
info: |
  ...
  3. Return SetViewValue(v, byteOffset, littleEndian, "Float32", value).

  24.2.1.2 SetViewValue ( view, requestIndex, isLittleEndian, type, value )
    ...
    3. Let numberIndex be ToNumber(requestIndex).
    4. Let getIndex be ? ToInteger(numberIndex).
    ...
    6. Let numberValue be ? ToNumber(value).
    ...
    11. Let viewSize be the value of view's [[ByteLength]] internal slot.
    12. Let elementSize be the Number value of the Element Size value specified in Table 49 for Element Type type.
    13. If getIndex + elementSize > viewSize, throw a RangeError exception.
    ...
---*/

var dataView = new DataView(new ArrayBuffer(8), 0);

var poisoned = {
  valueOf: function() {
    throw new Test262Error();
  }
};

assert.throws(Test262Error, function() {
  dataView.setFloat32(100, poisoned);
}, "setFloat32(100, poisoned)");

assert.throws(Test262Error, function() {
  dataView.setFloat32('100', poisoned);
}, "setFloat32('100', poisoned)");

reportCompare(0, 0);