retrieve-length-before-index-coercion.js (1208B)
1 // |reftest| skip-if(!this.hasOwnProperty('Atomics')) -- Atomics is not enabled unconditionally 2 // Copyright (C) 2025 André Bargull. All rights reserved. 3 // This code is governed by the BSD license found in the LICENSE file. 4 5 /*--- 6 esid: sec-atomics.notify 7 description: > 8 TypedArray length is retrieved before index parameter coercion. 9 info: | 10 25.4.15 Atomics.notify ( typedArray, index, count ) 11 ... 12 2. Let byteIndexInBuffer be ? ValidateAtomicAccess(taRecord, index). 13 ... 14 15 25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex ) 16 1. Let length be TypedArrayLength(taRecord). 17 2. Let accessIndex be ? ToIndex(requestIndex). 18 3. Assert: accessIndex ≥ 0. 19 4. If accessIndex ≥ length, throw a RangeError exception. 20 ... 21 features: [Atomics, TypedArray, resizable-arraybuffer] 22 ---*/ 23 24 var gsab = new SharedArrayBuffer(0, {maxByteLength: 4}); 25 var ta = new Int32Array(gsab); 26 27 var index = { 28 valueOf() { 29 gsab.grow(4); 30 return 0; 31 } 32 }; 33 34 var count = { 35 valueOf() { 36 throw new Test262Error("Unexpected count coercion"); 37 } 38 }; 39 40 assert.throws(RangeError, function() { 41 Atomics.notify(ta, index, count); 42 }); 43 44 assert.sameValue(gsab.byteLength, 4); 45 46 reportCompare(0, 0);