third_party/WebKit/LayoutTests/fast/canvas/webgl/array-override-set.html

   1 <html>
   2 <head>
   3 <script src="../../../resources/js-test.js"></script>
   4 <script src="resources/webgl-test.js"></script>
   5 </head>
   6 <body>
   7 <div id="description"></div>
   8 <div id="console"></div>
   9
  10 <script>
  11 description("Test overriding the set method of WebGL array");
  12
  13 debug('Regression test for <a href="https://bugs.webkit.org/show_bug.cgi?id=87862">https://bugs.webkit.org/show_bug.cgi?id=87862</a> : <code>[v8] Crash after redefining setter on typed array to a number</code>');
  14
  15 var array;
  16 var typeNames = ['Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int32Array',
  17                  'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array']
  18
  19 function overrideSetWithNumberAndConstruct(typeName) {
  20   var type = window[typeName];
  21   type.prototype.set = 0x3ffff;
  22   array = new type([0], function() {});
  23   shouldBe("array[0]", "0");
  24 }
  25
  26 for (var i = 0; i < typeNames.length; i++) {
  27   overrideSetWithNumberAndConstruct(typeNames[i]);
  28 }
  29
  30 function overrideSetWithNumberAndSet(typeName) {
  31   var type = window[typeName];
  32   array = new type(10);
  33   type.prototype.set = 0x3ffff;
  34   array[0] = 8;
  35   array.set([0], function() {});
  36   shouldBe("array[0]", "0");
  37 }
  38
  39 for (var i = 0; i < typeNames.length; i++) {
  40   overrideSetWithNumberAndConstruct(typeNames[i]);
  41 }
  42
  43 </script>
  44
  45 </body>
  46 </html>