tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

define-own-prop-length-overflow-order.js (1241B)

      1 // Copyright (C) 2020 Alexey Shvayka. All rights reserved.
      2 // This code is governed by the BSD license found in the LICENSE file.
      3 
      4 /*---
      5 esid: sec-arraysetlength
      6 description: >
      7  [[Value]] is checked for overflow before descriptor validation.
      8 info: |
      9  ArraySetLength ( A, Desc )
     10 
     11  [...]
     12  3. Let newLen be ? ToUint32(Desc.[[Value]]).
     13  4. Let numberLen be ? ToNumber(Desc.[[Value]]).
     14  5. If newLen ≠ numberLen, throw a RangeError exception.
     15 ---*/
     16 
     17 assert.throws(RangeError, function() {
     18  Object.defineProperty([], "length", {value: -1, configurable: true});
     19 }, 'Object.defineProperty([], "length", {value: -1, configurable: true}) throws a RangeError exception');
     20 
     21 assert.throws(RangeError, function() {
     22  Object.defineProperty([], "length", {value: NaN, enumerable: true});
     23 }, 'Object.defineProperty([], "length", {value: NaN, enumerable: true}) throws a RangeError exception');
     24 
     25 var array = [];
     26 Object.defineProperty(array, "length", {writable: false});
     27 assert.throws(RangeError, function() {
     28  Object.defineProperty(array, "length", {value: Number.MAX_SAFE_INTEGER, writable: true});
     29 }, 'Object.defineProperty(array, "length", {value: Number.MAX_SAFE_INTEGER, writable: true}) throws a RangeError exception');
     30 
     31 reportCompare(0, 0);