[SAB] Validate index before value conversion

test/mjsunit/harmony/atomics.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-sharedarraybuffer
 //
 
 function toRangeWrapped(value) {
   var range = this.max - this.min + 1;
   while (value < this.min) {
@@ skipping 44 matching lines @@
     assertThrows(function() { Atomics.xor(o, 0, 0); }, TypeError);
     assertThrows(function() { Atomics.exchange(o, 0, 0); }, TypeError);
   });
 })();
 
 (function TestBadIndex() {
   var sab = new SharedArrayBuffer(8);
   var si32a = new Int32Array(sab);
   var si32a2 = new Int32Array(sab, 4);
 
-  // Non-integer indexes should throw RangeError.
-  var nonInteger = [1.4, '1.4', NaN, -Infinity, Infinity, undefined, 'hi', {}];
-  nonInteger.forEach(function(i) {
+  // Indexes that are out of bounds when coerced via ToIndex should throw
+  // RangeError.
+  [-Infinity, Infinity].forEach(function(i) {
     assertThrows(function() { Atomics.compareExchange(si32a, i, 0); },
                  RangeError);
     assertThrows(function() { Atomics.load(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.store(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.add(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.sub(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.and(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.or(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.xor(si32a, i, 0); }, RangeError);
     assertThrows(function() { Atomics.exchange(si32a, i, 0); }, RangeError);
@@ skipping 55 matching lines @@
     assertEquals(0, result, name);
     assertEquals(0, ia[expectedIndex], name);
 
     for (var i = 0; i < ia.length; ++i) {
       if (i == expectedIndex) continue;
       assertEquals(i * 2, ia[i], name);
     }
   };
 
   // These values all map to index 0
-  [-0, 0, 0.0, null, false].forEach(function(i) {
+  [-0, 0, 0.0, null, false, NaN, {}, '0.2', 'hi', undefined].forEach(
+      function(i) {
     var name = String(i);
     [si32a, si32a2].forEach(function(array) {
       testOp(Atomics.compareExchange, array, i, 0, name);
       testOp(Atomics.load, array, i, 0, name);
       testOp(Atomics.store, array, i, 0, name);
       testOp(Atomics.add, array, i, 0, name);
       testOp(Atomics.sub, array, i, 0, name);
       testOp(Atomics.and, array, i, 0, name);
       testOp(Atomics.or, array, i, 0, name);
       testOp(Atomics.xor, array, i, 0, name);
@@ skipping 403 matching lines @@
       // Exchange
       sta[0] = val = 0x12;
       operand = 0x22 + offset;
       valWrapped = t.toRange(operand);
       assertEquals(val, Atomics.exchange(sta, 0, operand), name);
       assertEquals(valWrapped, sta[0], name);
     }
 
   });
 })();
+
+(function TestValidateIndexBeforeValue() {
+  var testOp = function(op, sta, name) {
+    var dummy = 0;

[Jakob Kummerow, 2017/04/12 11:47:33]

maybe s/dummy/valueof_has_been_called/? Descriptive names FTW!

[binji, 2017/04/12 18:43:44]

Good point, done!

+    var value = {valueOf: function() { dummy = 1; return 0; }};
+    var index = -1;
+
+    // The index should be checked before calling ToInteger on the value, so
+    // dummy should not be modified.
+    sta[0] = 0;
+    assertThrows(function() { op(sta, index, value, value); }, RangeError);
+    assertEquals(0, dummy);
+  };
+
+  IntegerTypedArrayConstructors.forEach(function(t) {
+    var sab = new SharedArrayBuffer(10 * t.constr.BYTES_PER_ELEMENT);
+    var sta = new t.constr(sab);
+    var name = Object.prototype.toString.call(sta);
+
+    testOp(Atomics.compareExchange, sta, name);
+    testOp(Atomics.load, sta, name);
+    testOp(Atomics.store, sta, name);
+    testOp(Atomics.add, sta, name);
+    testOp(Atomics.sub, sta, name);
+    testOp(Atomics.and, sta, name);
+    testOp(Atomics.or, sta, name);
+    testOp(Atomics.xor, sta, name);
+    testOp(Atomics.exchange, sta, name);
+  });
+})();