1a1639de3e
Original commit message:
[rab/gsab] Remove --harmony-rab-gsab (has been on by default for a while)
Bug: v8:11111
Change-Id: Ie74e7737f3e2e8730820cf00f1cbc7ae02b515af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5516580
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93848}
Refs: 9ebca66a57
PR-URL: https://github.com/nodejs/node/pull/53522
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/53755
Fixes: https://github.com/nodejs/node/issues/53579
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
52 lines
1.4 KiB
JavaScript
52 lines
1.4 KiB
JavaScript
// Copyright 2022 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
(function Test_OOB() {
|
|
function f() {
|
|
try {
|
|
const buffer = new ArrayBuffer(42, {'maxByteLength': 42});
|
|
const view = new DataView(buffer, 0, 42);
|
|
// Resize the buffer to smaller than the view.
|
|
buffer.resize(20);
|
|
// Any access in the view should throw.
|
|
view.setInt8(11, 0xab);
|
|
return 'did not prevent out-of-bounds access';
|
|
} catch (e) {
|
|
return 'ok';
|
|
}
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(f);
|
|
assertEquals('ok', f());
|
|
assertEquals('ok', f());
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertEquals('ok', f());
|
|
assertEquals('ok', f());
|
|
}());
|
|
|
|
(function Test_OOB_WithOffset() {
|
|
function f() {
|
|
try {
|
|
const buffer = new ArrayBuffer(42, {'maxByteLength': 42});
|
|
const view = new DataView(buffer, 30, 42);
|
|
// Resize the buffer to smaller than the view.
|
|
buffer.resize(40);
|
|
// Any access in the view should throw.
|
|
view.setInt8(11, 0xab);
|
|
return 'did not prevent out-of-bounds access';
|
|
} catch (e) {
|
|
return 'ok';
|
|
}
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(f);
|
|
assertEquals('ok', f());
|
|
assertEquals('ok', f());
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertEquals('ok', f());
|
|
assertEquals('ok', f());
|
|
}());
|