| <html> |
| <head> |
| <script src="../../../resources/js-test.js"></script> |
| <script src="resources/webgl-test.js"></script> |
| </head> |
| <body> |
| <div id="description"></div> |
| <div id="console"></div> |
| |
| <script> |
| description("Test overriding the set method of WebGL array"); |
| |
| debug('Regression test for <a href="https://bugs.webkit.org/show_bug.cgi?id=87862">https://bugs.webkit.org/show_bug.cgi?id=87862</a> : <code>[v8] Crash after redefining setter on typed array to a number</code>'); |
| |
| var array; |
| var typeNames = ['Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int32Array', |
| 'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array'] |
| |
| function overrideSetWithNumberAndConstruct(typeName) { |
| var type = window[typeName]; |
| type.prototype.set = 0x3ffff; |
| array = new type([0], function() {}); |
| shouldBe("array[0]", "0"); |
| } |
| |
| for (var i = 0; i < typeNames.length; i++) { |
| overrideSetWithNumberAndConstruct(typeNames[i]); |
| } |
| |
| function overrideSetWithNumberAndSet(typeName) { |
| var type = window[typeName]; |
| array = new type(10); |
| type.prototype.set = 0x3ffff; |
| array[0] = 8; |
| array.set([0], function() {}); |
| shouldBe("array[0]", "0"); |
| } |
| |
| for (var i = 0; i < typeNames.length; i++) { |
| overrideSetWithNumberAndConstruct(typeNames[i]); |
| } |
| |
| </script> |
| </body> |
| </html> |
