| OLD | NEW |
|---|
| 1 <html> | 1 <html> |
| 2 <head> | 2 <head> |
| 3 <link rel="stylesheet" href="../../js/resources/js-test-style.css"/> | 3 <link rel="stylesheet" href="../../js/resources/js-test-style.css"/> |
| 4 <script src="../../js/resources/js-test-pre.js"></script> | 4 <script src="../../js/resources/js-test-pre.js"></script> |
| 5 </head> | 5 </head> |
| 6 <body> | 6 <body> |
| 7 <div id="description"></div> | 7 <div id="description"></div> |
| 8 <div id="console"></div> | 8 <div id="console"></div> |
| 9 | 9 |
| 10 <script> | 10 <script> |
| 11 description("Test that DataView does not crash with bad offset or length."); | 11 description("Test that DataView does not crash with bad offset or length."); |
| 12 | 12 |
| 13 var array = new Uint8Array([164, 112, 157, 63]); | 13 var array = new Uint8Array([164, 112, 157, 63]); |
| 14 var view; | 14 var view; |
| 15 shouldThrow("view = new DataView(array.buffer, -4500000000)"); | 15 shouldThrow("view = new DataView(array.buffer, -4500000000)"); |
| 16 shouldThrow("view = new DataView(array.buffer, -4500000000, 4500000000)"); | 16 shouldThrow("view = new DataView(array.buffer, -4500000000, 4500000000)"); |
| 17 var value = view ? view.getFloat32(0, true) : 0; | 17 var value = view ? view.getFloat32(0, true) : 0; |
| 18 | 18 |
| 19 successfullyParsed = true; | 19 successfullyParsed = true; |
| 20 </script> | 20 </script> |
| 21 | 21 |
| 22 <script src="../../js/resources/js-test-post.js"></script> | 22 <script src="../../js/resources/js-test-post.js"></script> |
| 23 </body> | 23 </body> |
| 24 </html> | 24 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 5556003:
Merge 73208 - Integer calculation issues in DataView constructor... (Closed)
Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/597/