tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

push-slowly-loopy-nonwritable-length.js (1375B)


      1 load(libdir + "asserts.js");
      2 
      3 function f(arr, v1, v2)
      4 {
      5  // Ensure array_push_slowly is called by passing more than one argument.
      6  arr.push(v1, v2);
      7 }
      8 
      9 var N = 100;
     10 
     11 function test(out)
     12 {
     13  // Create an array of arrays, to be iterated over for [].push-calling.  We
     14  // can't just loop on push on a single array with non-writable length because
     15  // push throws when called on an array with non-writable length.
     16  var arrs = out.arrs = [];
     17  for (var i = 0; i < N; i++)
     18    arrs.push([]);
     19 
     20  // Use a much-greater capacity than the eventual non-writable length.
     21  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
     22  Object.defineProperty(a, "length", { writable: false, value: 6 });
     23 
     24  arrs.push(a);
     25 
     26  for (var i = 0, sz = arrs.length; i < sz; i++)
     27  {
     28    var arr = arrs[i];
     29    f(arr, 8675309, 3141592);
     30  }
     31 }
     32 
     33 var obj = {};
     34 
     35 assertThrowsInstanceOf(function() { test(obj); }, TypeError);
     36 
     37 var arrs = obj.arrs;
     38 assertEq(arrs.length, N + 1);
     39 for (var i = 0; i < N; i++)
     40 {
     41  assertEq(arrs[i].length, 2, "unexpected length for arrs[" + i + "]");
     42  assertEq(arrs[i][0], 8675309, "bad element for arrs[" + i + "][0]");
     43  assertEq(arrs[i][1], 3141592, "bad element for arrs[" + i + "][1]");
     44 }
     45 
     46 var a = arrs[N];
     47 assertEq(a.hasOwnProperty(6), false);
     48 assertEq(a[6], undefined);
     49 assertEq(a.hasOwnProperty(7), false);
     50 assertEq(a[7], undefined);
     51 assertEq(a.length, 6);