tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

push-densely-loopy-nonwritable-length.js (1360B)


      1 // Force recognition of a known-constant.
      2 var push = Array.prototype.push;
      3 
      4 function f(arr)
      5 {
      6  // Push an actual constant to trigger JIT-inlining of the effect of the push.
      7  push.call(arr, 99);
      8 }
      9 
     10 function basic(out)
     11 {
     12  // Create an array of arrays, to be iterated over for [].push-calling.  We
     13  // can't just loop on push on a single array with non-writable length because
     14  // push throws when called on an array with non-writable length.
     15  var arrs = out.arrs = [];
     16  for (var i = 0; i < 100; i++)
     17    arrs.push([]);
     18 
     19  // Use a much-greater capacity than the eventual non-writable length.
     20  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
     21  Object.defineProperty(a, "length", { writable: false, value: 6 });
     22 
     23  arrs.push(a);
     24 
     25  for (var i = 0, sz = arrs.length; i < sz; i++)
     26  {
     27    var arr = arrs[i];
     28    f(arr);
     29  }
     30 }
     31 
     32 var obj = {};
     33 var arrs, a;
     34 
     35 try
     36 {
     37  basic(obj);
     38  throw new Error("didn't throw!");
     39 }
     40 catch (e)
     41 {
     42  assertEq(e instanceof TypeError, true, "expected TypeError, got " + e);
     43 
     44  arrs = obj.arrs;
     45  assertEq(arrs.length, 101);
     46  for (var i = 0; i < 100; i++)
     47  {
     48    assertEq(arrs[i].length, 1, "unexpected length for arrs[" + i + "]");
     49    assertEq(arrs[i][0], 99, "bad element for arrs[" + i + "]");
     50  }
     51 
     52  a = arrs[100];
     53  assertEq(a.hasOwnProperty(6), false);
     54  assertEq(a[6], undefined);
     55  assertEq(a.length, 6);
     56 }