OLD | NEW |
| (Empty) |
1 <html> | |
2 <head> | |
3 <script src="../../../resources/js-test.js"></script> | |
4 <script src="resources/webgl-test.js"></script> | |
5 </head> | |
6 <body> | |
7 <div id="description"></div> | |
8 <div id="console"></div> | |
9 | |
10 <script> | |
11 description("Test overriding the set method of WebGL array"); | |
12 | |
13 debug('Regression test for <a href="https://bugs.webkit.org/show_bug.cgi?id=8786
2">https://bugs.webkit.org/show_bug.cgi?id=87862</a> : <code>[v8] Crash after re
defining setter on typed array to a number</code>'); | |
14 | |
15 var array; | |
16 var typeNames = ['Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int
32Array', | |
17 'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array'
] | |
18 | |
19 function overrideSetWithNumberAndConstruct(typeName) { | |
20 var type = window[typeName]; | |
21 type.prototype.set = 0x3ffff; | |
22 array = new type([0], function() {}); | |
23 shouldBe("array[0]", "0"); | |
24 } | |
25 | |
26 for (var i = 0; i < typeNames.length; i++) { | |
27 overrideSetWithNumberAndConstruct(typeNames[i]); | |
28 } | |
29 | |
30 function overrideSetWithNumberAndSet(typeName) { | |
31 var type = window[typeName]; | |
32 array = new type(10); | |
33 type.prototype.set = 0x3ffff; | |
34 array[0] = 8; | |
35 array.set([0], function() {}); | |
36 shouldBe("array[0]", "0"); | |
37 } | |
38 | |
39 for (var i = 0; i < typeNames.length; i++) { | |
40 overrideSetWithNumberAndConstruct(typeNames[i]); | |
41 } | |
42 | |
43 </script> | |
44 | |
45 </body> | |
46 </html> | |
OLD | NEW |