tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

custom-proto-access-resizes-buffer-valid-by-length.js (1184B)


      1 // Copyright (C) 2021 the V8 project authors. All rights reserved.
      2 // This code is governed by the BSD license found in the LICENSE file.
      3 /*---
      4 esid: sec-dataview-buffer-byteoffset-bytelength
      5 description: >
      6  The sum of the view's offset and byte length may equal the underlying
      7  buffer's byte length if it is modified during retrieval of the NewTarget's
      8  prototype.
      9 features: [resizable-arraybuffer]
     10 ---*/
     11 
     12 // If the host chooses to throw as allowed by the specification, the observed
     13 // behavior will be identical to the case where `ArrayBuffer.prototype.resize`
     14 // has not been implemented. The following assertion prevents this test from
     15 // passing in runtimes which have not implemented the method.
     16 assert.sameValue(typeof ArrayBuffer.prototype.resize, 'function');
     17 
     18 var buffer = new ArrayBuffer(3, {maxByteLength: 3});
     19 
     20 var newTarget = function() {}.bind(null);
     21 Object.defineProperty(newTarget, 'prototype', {
     22  get: function() {
     23    try {
     24      buffer.resize(2);
     25    } catch (error) {}
     26  }
     27 });
     28 
     29 var result = Reflect.construct(DataView, [buffer, 1, 1], newTarget);
     30 
     31 assert.sameValue(result.constructor, DataView);
     32 assert.sameValue(result.byteLength, 1);
     33 
     34 reportCompare(0, 0);