tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

store-dense-element-hole-non-writable-length-at-start.js (1254B)


      1 // Store an element into a previous hole value and later add more elements
      2 // exceeding the initialised length. Cover both mono- and polymorphic call
      3 // sites. The array has a non-writable length at the start.
      4 
      5 function testStoreDenseHole() {
      6  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
      7  Object.defineProperty(array, "length", {
      8      writable: false
      9  });
     10 
     11  function store(ar, index) {
     12    ar[index] = index;
     13  }
     14 
     15  for (var i = 0; i < 10; ++i) {
     16    store(array, i);
     17  }
     18 
     19  assertEq(array.length, 4);
     20  for (var i = 0; i < 4; ++i) {
     21    assertEq(array[i], i);
     22  }
     23  for (var i = 4; i < 10; ++i) {
     24    assertEq(i in array, false);
     25  }
     26 }
     27 testStoreDenseHole();
     28 
     29 function testStoreDenseHolePoly() {
     30  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
     31  Object.defineProperty(array, "length", {
     32    writable: false
     33  });
     34 
     35  function store(ar, index) {
     36    ar[index] = index;
     37  }
     38 
     39  var objects = [array, {}];
     40 
     41  for (var i = 0; i < 10; ++i) {
     42    for (var j = 0; j < objects.length; ++j) {
     43      store(objects[j], i);
     44    }
     45  }
     46 
     47  assertEq(array.length, 4);
     48  for (var i = 0; i < 4; ++i) {
     49    assertEq(array[i], i);
     50  }
     51  for (var i = 4; i < 10; ++i) {
     52    assertEq(i in array, false);
     53  }
     54 }
     55 testStoreDenseHolePoly();