blob: c1776f6a918a92e83f02c6791863679b0e97b66d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
<html>
<head>
<script src="../../../resources/js-test.js"></script>
<script src="resources/webgl-test.js"></script>
</head>
<body>
<div id="description"></div>
<div id="console"></div>
<script>
description("Test overriding the set method of WebGL array");
debug('Regression test for <a href="https://bugs.webkit.org/show_bug.cgi?id=87862">https://bugs.webkit.org/show_bug.cgi?id=87862</a> : <code>[v8] Crash after redefining setter on typed array to a number</code>');
var array;
var typeNames = ['Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int32Array',
'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array']
function overrideSetWithNumberAndConstruct(typeName) {
var type = window[typeName];
type.prototype.set = 0x3ffff;
array = new type([0], function() {});
shouldBe("array[0]", "0");
}
for (var i = 0; i < typeNames.length; i++) {
overrideSetWithNumberAndConstruct(typeNames[i]);
}
function overrideSetWithNumberAndSet(typeName) {
var type = window[typeName];
array = new type(10);
type.prototype.set = 0x3ffff;
array[0] = 8;
array.set([0], function() {});
shouldBe("array[0]", "0");
}
for (var i = 0; i < typeNames.length; i++) {
overrideSetWithNumberAndConstruct(typeNames[i]);
}
</script>
</body>
</html>
|
