tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

poisoned-object-for-timeout-throws-agent.js (2172B)

      1 // |reftest| skip-if(!this.hasOwnProperty('Atomics')||!this.hasOwnProperty('SharedArrayBuffer')||(this.hasOwnProperty('getBuildConfiguration')&&getBuildConfiguration('arm64-simulator'))) -- Atomics,SharedArrayBuffer is not enabled unconditionally, ARM64 Simulator cannot emulate atomics
      2 // Copyright (C) 2018 Amal Hussein.  All rights reserved.
      3 // This code is governed by the BSD license found in the LICENSE file.
      4 
      5 /*---
      6 esid: sec-atomics.wait
      7 description: >
      8  False timeout arg should result in an +0 timeout
      9 info: |
     10  Atomics.wait( typedArray, index, value, timeout )
     11 
     12  4. Let q be ? ToNumber(timeout).
     13 
     14    Null -> Return +0.
     15 
     16 includes: [atomicsHelper.js]
     17 features: [Atomics, SharedArrayBuffer, TypedArray]
     18 ---*/
     19 
     20 const RUNNING = 1;
     21 
     22 $262.agent.start(`
     23  const poisonedValueOf = {
     24    valueOf: function() {
     25      throw new Error("should not evaluate this code");
     26    }
     27  };
     28 
     29  const poisonedToPrimitive = {
     30    [Symbol.toPrimitive]: function() {
     31      throw new Error("passing a poisoned object using @@ToPrimitive");
     32    }
     33  };
     34 
     35  $262.agent.receiveBroadcast(function(sab) {
     36    const i32a = new Int32Array(sab);
     37    Atomics.add(i32a, ${RUNNING}, 1);
     38 
     39    let status1 = "";
     40    let status2 = "";
     41 
     42    try {
     43      Atomics.wait(i32a, 0, 0, poisonedValueOf);
     44    } catch (error) {
     45      status1 = "poisonedValueOf";
     46    }
     47    try {
     48      Atomics.wait(i32a, 0, 0, poisonedToPrimitive);
     49    } catch (error) {
     50      status2 = "poisonedToPrimitive";
     51    }
     52 
     53    $262.agent.report(status1);
     54    $262.agent.report(status2);
     55    $262.agent.leaving();
     56  });
     57 `);
     58 
     59 const i32a = new Int32Array(
     60  new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * 4)
     61 );
     62 
     63 $262.agent.safeBroadcast(i32a);
     64 $262.agent.waitUntil(i32a, RUNNING, 1);
     65 
     66 // Try to yield control to ensure the agent actually started to wait.
     67 $262.agent.tryYield();
     68 
     69 assert.sameValue(
     70  $262.agent.getReport(),
     71  'poisonedValueOf',
     72  '$262.agent.getReport() returns "poisonedValueOf"'
     73 );
     74 assert.sameValue(
     75  $262.agent.getReport(),
     76  'poisonedToPrimitive',
     77  '$262.agent.getReport() returns "poisonedToPrimitive"'
     78 );
     79 
     80 assert.sameValue(Atomics.notify(i32a, 0), 0, 'Atomics.notify(i32a, 0) returns 0');
     81 
     82 reportCompare(0, 0);