tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

retrieve-length-before-index-coercion-non-shared-resize-to-zero.js (1076B)

      1 // |reftest| skip-if(!this.hasOwnProperty('Atomics')) -- Atomics is not enabled unconditionally
      2 // Copyright (C) 2025 André Bargull. All rights reserved.
      3 // This code is governed by the BSD license found in the LICENSE file.
      4 
      5 /*---
      6 esid: sec-atomics.notify
      7 description: >
      8  TypedArray length is retrieved before index parameter coercion.
      9 info: |
     10  25.4.15 Atomics.notify ( typedArray, index, count )
     11    ...
     12    2. Let byteIndexInBuffer be ? ValidateAtomicAccess(taRecord, index).
     13    ...
     14 
     15  25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
     16    1. Let length be TypedArrayLength(taRecord).
     17    2. Let accessIndex be ? ToIndex(requestIndex).
     18    3. Assert: accessIndex ≥ 0.
     19    4. If accessIndex ≥ length, throw a RangeError exception.
     20    ...
     21 features: [Atomics, TypedArray, resizable-arraybuffer]
     22 ---*/
     23 
     24 var rab = new ArrayBuffer(4, {maxByteLength: 4});
     25 var ta = new Int32Array(rab);
     26 
     27 var index = {
     28  valueOf() {
     29    rab.resize(0);
     30    return 0;
     31  }
     32 };
     33 
     34 assert.sameValue(Atomics.notify(ta, index), 0);
     35 
     36 assert.sameValue(rab.byteLength, 0);
     37 
     38 reportCompare(0, 0);