regress-479487.js (1069B)
1 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ 2 /* This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 5 6 //----------------------------------------------------------------------------- 7 var BUGNUMBER = 479487; 8 var summary = 'js_Array_dense_setelem can call arbitrary JS code'; 9 var actual = ''; 10 var expect = ''; 11 12 13 //----------------------------------------------------------------------------- 14 test(); 15 //----------------------------------------------------------------------------- 16 17 function test() 18 { 19 printBugNumber(BUGNUMBER); 20 printStatus (summary); 21 22 23 Array.prototype[1] = 2; 24 25 Array.prototype.__defineSetter__(32, function() { print("Hello from arbitrary JS");}); 26 Array.prototype.__defineGetter__(32, function() { return 11; }); 27 28 function f() 29 { 30 var a = []; 31 for (var i = 0; i != 10; ++i) { 32 a[1 << i] = 9999; 33 } 34 return a; 35 } 36 37 f(); 38 39 40 reportCompare(expect, actual, summary); 41 }