| OLD | NEW |
| (Empty) |
| 1 <html> | |
| 2 <head> | |
| 3 <script src="../../../resources/js-test.js"></script> | |
| 4 <script src="resources/webgl-test.js"></script> | |
| 5 </head> | |
| 6 <body> | |
| 7 <div id="description"></div> | |
| 8 <div id="console"></div> | |
| 9 | |
| 10 <script> | |
| 11 description("Test overriding the set method of WebGL array"); | |
| 12 | |
| 13 debug('Regression test for <a href="https://bugs.webkit.org/show_bug.cgi?id=8786
2">https://bugs.webkit.org/show_bug.cgi?id=87862</a> : <code>[v8] Crash after re
defining setter on typed array to a number</code>'); | |
| 14 | |
| 15 var array; | |
| 16 var typeNames = ['Float32Array', 'Float64Array', 'Int8Array', 'Int16Array', 'Int
32Array', | |
| 17 'Uint8Array', 'Uint8ClampedArray', 'Uint16Array', 'Uint32Array'
] | |
| 18 | |
| 19 function overrideSetWithNumberAndConstruct(typeName) { | |
| 20 var type = window[typeName]; | |
| 21 type.prototype.set = 0x3ffff; | |
| 22 array = new type([0], function() {}); | |
| 23 shouldBe("array[0]", "0"); | |
| 24 } | |
| 25 | |
| 26 for (var i = 0; i < typeNames.length; i++) { | |
| 27 overrideSetWithNumberAndConstruct(typeNames[i]); | |
| 28 } | |
| 29 | |
| 30 function overrideSetWithNumberAndSet(typeName) { | |
| 31 var type = window[typeName]; | |
| 32 array = new type(10); | |
| 33 type.prototype.set = 0x3ffff; | |
| 34 array[0] = 8; | |
| 35 array.set([0], function() {}); | |
| 36 shouldBe("array[0]", "0"); | |
| 37 } | |
| 38 | |
| 39 for (var i = 0; i < typeNames.length; i++) { | |
| 40 overrideSetWithNumberAndConstruct(typeNames[i]); | |
| 41 } | |
| 42 | |
| 43 </script> | |
| 44 | |
| 45 </body> | |
| 46 </html> | |
| OLD | NEW |