tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

reviver-array-length-get-err.js (1007B)


      1 // Copyright (C) 2016 the V8 project authors. All rights reserved.
      2 // This code is governed by the BSD license found in the LICENSE file.
      3 /*---
      4 esid: sec-internalizejsonproperty
      5 description: >
      6  Abrupt completion from array "length" property access while reviving
      7 info: |
      8  JSON.parse ( text [ , reviver ] )
      9 
     10  [...]
     11  7. If IsCallable(reviver) is true, then
     12     [...]
     13     e. Return ? InternalizeJSONProperty(root, rootName).
     14 
     15  Runtime Semantics: InternalizeJSONProperty ( holder, name)
     16 
     17  1. Let val be ? Get(holder, name).
     18  2. If Type(val) is Object, then
     19     a. Let isArray be ? IsArray(val).
     20     b. If isArray is true, then
     21        i. Set I to 0.
     22        ii. Let len be ? ToLength(? Get(val, "length")).
     23 features: [Proxy]
     24 ---*/
     25 
     26 var badLength = new Proxy([], {
     27  get: function(_, name) {
     28    if (name === 'length') {
     29      throw new Test262Error();
     30    }
     31  }
     32 });
     33 
     34 assert.throws(Test262Error, function() {
     35  JSON.parse('[0,0]', function() {
     36    this[1] = badLength;
     37  });
     38 });
     39 
     40 reportCompare(0, 0);