From 1654cf7b7f842120d98963de9dfe8835a37054f0 Mon Sep 17 00:00:00 2001
From: Jeff Walden <jwalden@mit.edu>
Date: Wed, 14 May 2014 11:59:19 -0700
Subject: [PATCH] Bug 991981 - Test for typedArray.set(arraylike, offset) not
 asserting when arraylike.length neuters typedArray.  r=sfink

---
 ...edArray-set-object-funky-length-neuters.js | 67 +++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 js/src/tests/ecma_6/extensions/TypedArray-set-object-funky-length-neuters.js

diff --git a/js/src/tests/ecma_6/extensions/TypedArray-set-object-funky-length-neuters.js b/js/src/tests/ecma_6/extensions/TypedArray-set-object-funky-length-neuters.js
new file mode 100644
index 00000000000..768a1e70942
--- /dev/null
+++ b/js/src/tests/ecma_6/extensions/TypedArray-set-object-funky-length-neuters.js
@@ -0,0 +1,67 @@
+// |reftest| skip-if(!xulRuntime.shell) -- needs neuter()
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var gTestfile = "set-object-funky-length-neuters.js";
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 991981;
+var summary =
+  "%TypedArray.set(object with funky length property, numeric offset) " +
+  "shouldn't misbehave if the funky length property neuters this typed array";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var ctors = [Int8Array, Uint8Array, Uint8ClampedArray,
+             Int16Array, Uint16Array,
+             Int32Array, Uint32Array,
+             Float32Array, Float64Array];
+ctors.forEach(function(TypedArray) {
+  ["change-data", "same-data"].forEach(function(dataHandling) {
+    var buf = new ArrayBuffer(512 * 1024);
+    var ta = new TypedArray(buf);
+
+    var arraylike =
+      {
+        0: 17,
+        1: 42,
+        2: 3,
+        3: 99,
+        4: 37,
+        5: 9,
+        6: 72,
+        7: 31,
+        8: 22,
+        9: 0,
+        get length()
+        {
+          neuter(buf, dataHandling);
+          return 10;
+        }
+      };
+
+      var passed = false;
+      try
+      {
+        ta.set(arraylike, 0x1234);
+      }
+      catch (e)
+      {
+        passed = true;
+      }
+
+      assertEq(passed, true);
+  });
+});
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");