retrieve-length-before-index-coercion.js (1551B)
1 // |reftest| shell-option(--setpref=atomics_wait_async) skip-if(!this.hasOwnProperty('Atomics')||!xulRuntime.shell) -- Atomics is not enabled unconditionally, requires shell-options 2 // Copyright (C) 2025 André Bargull. All rights reserved. 3 // This code is governed by the BSD license found in the LICENSE file. 4 5 /*--- 6 esid: sec-atomics.waitasync 7 description: > 8 TypedArray length is retrieved before index parameter coercion. 9 info: | 10 25.4.14 Atomics.waitAsync ( typedArray, index, value, timeout ) 11 1. Return ? DoWait(async, typedArray, index, value, timeout). 12 13 25.4.3.14 DoWait ( mode, typedArray, index, value, timeout ) 14 ... 15 4. Let i be ? ValidateAtomicAccess(taRecord, index). 16 ... 17 18 25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex ) 19 1. Let length be TypedArrayLength(taRecord). 20 2. Let accessIndex be ? ToIndex(requestIndex). 21 3. Assert: accessIndex ≥ 0. 22 4. If accessIndex ≥ length, throw a RangeError exception. 23 ... 24 features: [Atomics.waitAsync, Atomics, TypedArray, resizable-arraybuffer] 25 ---*/ 26 27 var gsab = new SharedArrayBuffer(0, {maxByteLength: 4}); 28 var ta = new Int32Array(gsab); 29 30 var index = { 31 valueOf() { 32 gsab.grow(4); 33 return 0; 34 } 35 }; 36 37 var value = { 38 valueOf() { 39 throw new Test262Error("Unexpected value coercion"); 40 } 41 }; 42 43 var timeout = { 44 valueOf() { 45 throw new Test262Error("Unexpected timeout coercion"); 46 } 47 }; 48 49 assert.throws(RangeError, function() { 50 Atomics.waitAsync(ta, index, value, timeout); 51 }); 52 53 assert.sameValue(gsab.byteLength, 4); 54 55 reportCompare(0, 0);