tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

custom-proto-access-resizes-buffer-invalid-by-length.js (1290B)


      1 // Copyright (C) 2021 the V8 project authors. All rights reserved.
      2 // This code is governed by the BSD license found in the LICENSE file.
      3 /*---
      4 esid: sec-dataview-buffer-byteoffset-bytelength
      5 description: >
      6  The sum of the view's offset and byte length cannot exceed the underlying
      7  buffer's byte length if it is modified during retrieval of the NewTarget's
      8  prototype.
      9 features: [resizable-arraybuffer]
     10 ---*/
     11 
     12 // If the host chooses to throw as allowed by the specification, the observed
     13 // behavior will be identical to the case where `ArrayBuffer.prototype.resize`
     14 // has not been implemented. The following assertion prevents this test from
     15 // passing in runtimes which have not implemented the method.
     16 assert.sameValue(typeof ArrayBuffer.prototype.resize, 'function');
     17 
     18 var buffer = new ArrayBuffer(3, {maxByteLength: 3});
     19 var expectedError;
     20 
     21 var newTarget = function() {}.bind(null);
     22 Object.defineProperty(newTarget, 'prototype', {
     23  get: function() {
     24    try {
     25      buffer.resize(2);
     26      expectedError = RangeError;
     27    } catch (error) {
     28      expectedError = null;
     29    }
     30  }
     31 });
     32 var error = null;
     33 
     34 try {
     35  Reflect.construct(DataView, [buffer, 1, 2], newTarget);
     36 } catch (caught) {
     37  error = caught.constructor;
     38 }
     39 
     40 assert.sameValue(error, expectedError);
     41 
     42 reportCompare(0, 0);