tyler.durden/test262
1
0
Fork 0
mirror of https://github.com/tc39/test262.git synced 2025-07-22 13:34:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure typed array length is retrieved early in Atomics.{notify,wait}

Browse Source
This commit is contained in:
André Bargull 2025-05-15 13:39:46 +02:00 committed by Ms2ger
parent 37ebe00a15
commit 1049f77ba3
6 changed files with 261 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
test/built-ins/Atomics/notify/retrieve-length-before-index-coercion-non-shared-detached.js Normal file
View File

@ -0,0 +1,36 @@
// Copyright (C) 2025 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-atomics.notify
description: >
TypedArray length is retrieved before index parameter coercion.
info: |
25.4.15 Atomics.notify ( typedArray, index, count )
...
2. Let byteIndexInBuffer be ? ValidateAtomicAccess(taRecord, index).
...
25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
1. Let length be TypedArrayLength(taRecord).
2. Let accessIndex be ? ToIndex(requestIndex).
3. Assert: accessIndex ≥ 0.
4. If accessIndex ≥ length, throw a RangeError exception.
...
features: [Atomics, TypedArray]
includes: [detachArrayBuffer.js]
---*/
var ab = new ArrayBuffer(4);
var ta = new Int32Array(ab);
var index = {
valueOf() {
$DETACHBUFFER(ab);
return 0;
}
};
assert.sameValue(Atomics.notify(ta, index), 0);
assert.sameValue(ab.byteLength, 0);

35
test/built-ins/Atomics/notify/retrieve-length-before-index-coercion-non-shared-resize-to-zero.js Normal file
View File

@ -0,0 +1,35 @@
// Copyright (C) 2025 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-atomics.notify
description: >
TypedArray length is retrieved before index parameter coercion.
info: |
25.4.15 Atomics.notify ( typedArray, index, count )
...
2. Let byteIndexInBuffer be ? ValidateAtomicAccess(taRecord, index).
...
25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
1. Let length be TypedArrayLength(taRecord).
2. Let accessIndex be ? ToIndex(requestIndex).
3. Assert: accessIndex ≥ 0.
4. If accessIndex ≥ length, throw a RangeError exception.
...
features: [Atomics, TypedArray, resizable-arraybuffer]
---*/
var rab = new ArrayBuffer(4, {maxByteLength: 4});
var ta = new Int32Array(rab);
var index = {
valueOf() {
rab.resize(0);
return 0;
}
};
assert.sameValue(Atomics.notify(ta, index), 0);
assert.sameValue(rab.byteLength, 0);

43
test/built-ins/Atomics/notify/retrieve-length-before-index-coercion-non-shared.js Normal file
View File

@ -0,0 +1,43 @@
// Copyright (C) 2025 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-atomics.notify
description: >
TypedArray length is retrieved before index parameter coercion.
info: |
25.4.15 Atomics.notify ( typedArray, index, count )
...
2. Let byteIndexInBuffer be ? ValidateAtomicAccess(taRecord, index).
...
25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
1. Let length be TypedArrayLength(taRecord).
2. Let accessIndex be ? ToIndex(requestIndex).
3. Assert: accessIndex ≥ 0.
4. If accessIndex ≥ length, throw a RangeError exception.
...
features: [Atomics, TypedArray, resizable-arraybuffer]
---*/
var rab = new ArrayBuffer(0, {maxByteLength: 4});
var ta = new Int32Array(rab);
var index = {
valueOf() {
rab.resize(4);
return 0;
}
};
var count = {
valueOf() {
throw new Test262Error("Unexpected count coercion");
}
};
assert.throws(RangeError, function() {
Atomics.notify(ta, index, count);
});
assert.sameValue(rab.byteLength, 4);

43
test/built-ins/Atomics/notify/retrieve-length-before-index-coercion.js Normal file
View File

@ -0,0 +1,43 @@
// Copyright (C) 2025 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-atomics.notify
description: >
TypedArray length is retrieved before index parameter coercion.
info: |
25.4.15 Atomics.notify ( typedArray, index, count )
...
2. Let byteIndexInBuffer be ? ValidateAtomicAccess(taRecord, index).
...
25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
1. Let length be TypedArrayLength(taRecord).
2. Let accessIndex be ? ToIndex(requestIndex).
3. Assert: accessIndex ≥ 0.
4. If accessIndex ≥ length, throw a RangeError exception.
...
features: [Atomics, TypedArray, resizable-arraybuffer]
---*/
var gsab = new SharedArrayBuffer(0, {maxByteLength: 4});
var ta = new Int32Array(gsab);
var index = {
valueOf() {
gsab.grow(4);
return 0;
}
};
var count = {
valueOf() {
throw new Test262Error("Unexpected count coercion");
}
};
assert.throws(RangeError, function() {
Atomics.notify(ta, index, count);
});
assert.sameValue(gsab.byteLength, 4);

52
test/built-ins/Atomics/wait/retrieve-length-before-index-coercion.js Normal file
View File

@ -0,0 +1,52 @@
// Copyright (C) 2025 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-atomics.wait
description: >
TypedArray length is retrieved before index parameter coercion.
info: |
25.4.13 Atomics.wait ( typedArray, index, value, timeout )
1. Return ? DoWait(sync, typedArray, index, value, timeout).
25.4.3.14 DoWait ( mode, typedArray, index, value, timeout )
...
4. Let i be ? ValidateAtomicAccess(taRecord, index).
...
25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
1. Let length be TypedArrayLength(taRecord).
2. Let accessIndex be ? ToIndex(requestIndex).
3. Assert: accessIndex ≥ 0.
4. If accessIndex ≥ length, throw a RangeError exception.
...
features: [Atomics, TypedArray, resizable-arraybuffer]
---*/
var gsab = new SharedArrayBuffer(0, {maxByteLength: 4});
var ta = new Int32Array(gsab);
var index = {
valueOf() {
gsab.grow(4);
return 0;
}
};
var value = {
valueOf() {
throw new Test262Error("Unexpected value coercion");
}
};
var timeout = {
valueOf() {
throw new Test262Error("Unexpected timeout coercion");
}
};
assert.throws(RangeError, function() {
Atomics.wait(ta, index, value, timeout);
});
assert.sameValue(gsab.byteLength, 4);

52
test/built-ins/Atomics/waitAsync/retrieve-length-before-index-coercion.js Normal file
View File

@ -0,0 +1,52 @@
// Copyright (C) 2025 André Bargull. All rights reserved.
// This code is governed by the BSD license found in the LICENSE file.
/*---
esid: sec-atomics.waitasync
description: >
TypedArray length is retrieved before index parameter coercion.
info: |
25.4.14 Atomics.waitAsync ( typedArray, index, value, timeout )
1. Return ? DoWait(async, typedArray, index, value, timeout).
25.4.3.14 DoWait ( mode, typedArray, index, value, timeout )
...
4. Let i be ? ValidateAtomicAccess(taRecord, index).
...
25.4.3.2 ValidateAtomicAccess ( taRecord, requestIndex )
1. Let length be TypedArrayLength(taRecord).
2. Let accessIndex be ? ToIndex(requestIndex).
3. Assert: accessIndex ≥ 0.
4. If accessIndex ≥ length, throw a RangeError exception.
...
features: [Atomics.waitAsync, Atomics, TypedArray, resizable-arraybuffer]
---*/
var gsab = new SharedArrayBuffer(0, {maxByteLength: 4});
var ta = new Int32Array(gsab);
var index = {
valueOf() {
gsab.grow(4);
return 0;
}
};
var value = {
valueOf() {
throw new Test262Error("Unexpected value coercion");
}
};
var timeout = {
valueOf() {
throw new Test262Error("Unexpected timeout coercion");
}
};
assert.throws(RangeError, function() {
Atomics.waitAsync(ta, index, value, timeout);
});
assert.sameValue(gsab.byteLength, 4);