From 5c8fa59c4c84a459c5ffaa8bd3ff7a1caf0413c6 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Fri, 3 Nov 2017 12:54:17 -0700
Subject: [PATCH] Add tests for setting/defining an element of a typed array to
a value, where converting that value to the typed array element type detaches
the buffer underlying the typed array. (#1336)
---
.../tonumber-value-detached-buffer.js | 53 +++++++++++++++++++
.../Set/tonumber-value-detached-buffer.js | 44 +++++++++++++++
2 files changed, 97 insertions(+)
create mode 100644 test/built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer.js
create mode 100644 test/built-ins/TypedArrays/internals/Set/tonumber-value-detached-buffer.js
diff --git a/test/built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer.js b/test/built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer.js
new file mode 100644
index 0000000000..8076c74d80
--- /dev/null
+++ b/test/built-ins/TypedArrays/internals/DefineOwnProperty/tonumber-value-detached-buffer.js
@@ -0,0 +1,53 @@
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-integer-indexed-exotic-objects-defineownproperty-p-desc
+description: >
+ Defining a typed array element to a value that, when converted to the typed
+ array element type, detaches the typed array's underlying buffer, should
+ throw a TypeError and not modify the typed array.
+info: >
+ 9.4.5.3 [[DefineOwnProperty]] ( P, Desc )
+
+ ...
+ 3. If Type(P) is String, then
+ a. Let numericIndex be ! CanonicalNumericIndexString(P).
+ b. If numericIndex is not undefined, then
+ ...
+ x. If Desc has a [[Value]] field, then
+ 1. Let value be Desc.[[Value]].
+ 2. Return ? IntegerIndexedElementSet(O, numericIndex, value).
+ ...
+
+ 9.4.5.9 IntegerIndexedElementSet ( O, index, value )
+
+ ...
+ 15. Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue).
+ 16. Return true.
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [Reflect, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+ var ta = new TA([17]);
+
+ var desc =
+ {
+ value: {
+ valueOf: function() {
+ $262.detachArrayBuffer(ta.buffer);
+ return 42;
+ }
+ }
+ };
+
+ assert.throws(TypeError, function() {
+ Reflect.defineProperty(ta, 0, desc);
+ },
+ "detaching a ArrayBuffer during defining an element of a typed array " +
+ "viewing it should throw");
+
+ assert.sameValue(ta[0], 17, "typed array element shouldn't be set");
+});
+
diff --git a/test/built-ins/TypedArrays/internals/Set/tonumber-value-detached-buffer.js b/test/built-ins/TypedArrays/internals/Set/tonumber-value-detached-buffer.js
new file mode 100644
index 0000000000..92565fcd33
--- /dev/null
+++ b/test/built-ins/TypedArrays/internals/Set/tonumber-value-detached-buffer.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-integer-indexed-exotic-objects-set-p-v-receiver
+description: >
+ Setting a typed array element to a value that, when converted to the typed
+ array element type, detaches the typed array's underlying buffer, should
+ throw a TypeError and not modify the typed array.
+info: >
+ 9.4.5.5 [[Set]] ( P, V, Receiver)
+
+ ...
+ 2. If Type(P) is String, then
+ a. Let numericIndex be ! CanonicalNumericIndexString(P).
+ b. If numericIndex is not undefined, then
+ i. Return ? IntegerIndexedElementSet(O, numericIndex, V).
+ ...
+
+ 9.4.5.9 IntegerIndexedElementSet ( O, index, value )
+
+ ...
+ 15. Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue).
+ 16. Return true.
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [Reflect, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+ var ta = new TA([17]);
+
+ assert.throws(TypeError, function() {
+ Reflect.set(ta, 0, {
+ valueOf: function() {
+ $262.detachArrayBuffer(ta.buffer);
+ return 42;
+ }
+ });
+ },
+ "detaching a ArrayBuffer during setting an element of a typed array " +
+ "viewing it should throw");
+
+ assert.sameValue(ta[0], 17, "typed array element shouldn't be set");
+});
--
GitLab