summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/ion/bug998059.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/ion/bug998059.js')
-rw-r--r--js/src/jit-test/tests/ion/bug998059.js25
1 files changed, 25 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug998059.js b/js/src/jit-test/tests/ion/bug998059.js
new file mode 100644
index 000000000..fc2c68d7f
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug998059.js
@@ -0,0 +1,25 @@
+// Test various ways of changing the behavior of |typedArray.length|.
+
+function addLengthProperty() {
+ var x = new Uint16Array();
+ Object.defineProperty(x, "length", {value:1});
+ for (var i = 0; i < 5; i++)
+ assertEq(x.length, 1);
+}
+addLengthProperty();
+
+function changePrototype() {
+ var x = new Uint16Array();
+ x.__proto__ = [0];
+ for (var i = 0; i < 5; i++)
+ assertEq(x.length, 1);
+}
+changePrototype();
+
+function redefineLengthProperty() {
+ var x = new Uint16Array();
+ Object.defineProperty(Uint16Array.prototype, "length", {value:1});
+ for (var i = 0; i < 5; i++)
+ assertEq(x.length, 1);
+}
+redefineLengthProperty();