1 files changed, 80 insertions, 0 deletions
diff --git a/js/src/tests/non262/extensions/ArrayBuffer-slice-arguments-detaching.js b/js/src/tests/non262/extensions/ArrayBuffer-slice-arguments-detaching.js
new file mode 100644
index 0000000000..07cec18aa9
--- /dev/null
+++ b/js/src/tests/non262/extensions/ArrayBuffer-slice-arguments-detaching.js
@@ -0,0 +1,80 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var gTestfile = "ArrayBuffer-slice-arguments-detaching.js";
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 991981;
+var summary =
+  "ArrayBuffer.prototype.slice shouldn't misbehave horribly if " +
+  "index-argument conversion detaches the ArrayBuffer being sliced";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function testStart()
+{
+  var ab = new ArrayBuffer(0x1000);
+
+  var start =
+    {
+      valueOf: function()
+      {
+        detachArrayBuffer(ab);
+        gc();
+        return 0x800;
+      }
+    };
+
+  var ok = false;
+  try
+  {
+    ab.slice(start);
+  }
+  catch (e)
+  {
+    ok = true;
+  }
+  assertEq(ok, true, "start weirdness should have thrown");
+  assertEq(ab.byteLength, 0, "detaching should work for start weirdness");
+}
+testStart();
+
+function testEnd()
+{
+  var ab = new ArrayBuffer(0x1000);
+
+  var end =
+    {
+      valueOf: function()
+      {
+        detachArrayBuffer(ab);
+        gc();
+        return 0x1000;
+      }
+    };
+
+  var ok = false;
+  try
+  {
+    ab.slice(0x800, end);
+  }
+  catch (e)
+  {
+    ok = true;
+  }
+  assertEq(ok, true, "byteLength weirdness should have thrown");
+  assertEq(ab.byteLength, 0, "detaching should work for byteLength weirdness");
+}
+testEnd();
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");