blob: 33992a86966d13e593a106db31dac17a75b47457 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
if (!this.SharedArrayBuffer)
quit(0);
// This would hit an assertion in debug builds due to an incorrect
// type guard in the code that copies data from STA to TA.
// Original test case
var sab = new SharedArrayBuffer(4);
var x = new Int32Array(sab);
x.__proto__ = (function(){});
new Uint8Array(x); // Would assert here
// Supposedly equivalent test case, provoking the error directly
var x = new Int32Array(sab);
Object.defineProperty(x, "length", { value: 0 });
new Uint8Array(x); // Would assert here
// Derived test case - would not tickle the bug, though.
var x = new Int32Array(sab);
Object.defineProperty(x, "length", { value: 1 << 20 });
new Uint8Array(x);
|