30 lines
726 B
JavaScript
30 lines
726 B
JavaScript
![]() |
description(
|
||
|
"Tests what happens when you do a out-of-bounds access on a string and use that to install a getter that clobbers a structure."
|
||
|
);
|
||
|
|
||
|
function foo(s, o) {
|
||
|
var x = o.f;
|
||
|
s[42];
|
||
|
var y = o.g;
|
||
|
return x + y;
|
||
|
}
|
||
|
|
||
|
noInline(foo);
|
||
|
silentTestPass = true;
|
||
|
|
||
|
var theObject = {};
|
||
|
|
||
|
var didGetCalled = false;
|
||
|
String.prototype.__defineGetter__("42", function() { didGetCalled = true; delete theObject.g; theObject.h = 42 });
|
||
|
|
||
|
while (testRunner.numberOfDFGCompiles(foo) < 1) {
|
||
|
didGetCalled = false;
|
||
|
shouldBe("foo(\"hello\", {f:1, g:2})", "3");
|
||
|
shouldBe("didGetCalled", "true");
|
||
|
}
|
||
|
|
||
|
theObject = {f:1, g:2};
|
||
|
didGetCalled = false;
|
||
|
shouldBe("foo(\"hello\", theObject)", "0/0");
|
||
|
shouldBe("didGetCalled", "true");
|