tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

store-dense-element-hole-non-writable-length.js (1298B)

      1 // Store an element into a previous hole value and later add more elements
      2 // exceeding the initialised length. Cover both mono- and polymorphic call
      3 // sites. Change array length to non-writable during execution.
      4 
      5 function testStoreDenseHole() {
      6  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
      7 
      8  function store(ar, index) {
      9    ar[index] = index;
     10  }
     11 
     12  for (var i = 0; i < 10; ++i) {
     13    if (i === 5) {
     14      Object.defineProperty(array, "length", {writable: false});
     15    }
     16    store(array, i);
     17  }
     18 
     19  assertEq(array.length, 5);
     20  for (var i = 0; i < 5; ++i) {
     21    assertEq(array[i], i);
     22  }
     23  for (var i = 5; i < 10; ++i) {
     24    assertEq(i in array, false);
     25  }
     26 }
     27 testStoreDenseHole();
     28 
     29 function testStoreDenseHolePoly() {
     30  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
     31 
     32  function store(ar, index) {
     33    ar[index] = index;
     34  }
     35 
     36  var objects = [array, {}];
     37 
     38  for (var i = 0; i < 10; ++i) {
     39    if (i === 5) {
     40      Object.defineProperty(array, "length", {writable: false});
     41    }
     42    for (var j = 0; j < objects.length; ++j) {
     43      store(objects[j], i);
     44    }
     45  }
     46 
     47  assertEq(array.length, 5);
     48  for (var i = 0; i < 5; ++i) {
     49    assertEq(array[i], i);
     50  }
     51  for (var i = 5; i < 10; ++i) {
     52    assertEq(i in array, false);
     53  }
     54 }
     55 testStoreDenseHolePoly();