Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
michael@0 | 1 | function testInt32ToId() |
michael@0 | 2 | { |
michael@0 | 3 | // Ensure that a property which is a negative integer that does not fit in a |
michael@0 | 4 | // jsval is properly detected by the 'in' operator. |
michael@0 | 5 | var obj = { "-1073741828": 17 }; |
michael@0 | 6 | var index = -1073741819; |
michael@0 | 7 | var a = []; |
michael@0 | 8 | for (var i = 0; i < 10; i++) |
michael@0 | 9 | { |
michael@0 | 10 | a.push(index in obj); |
michael@0 | 11 | index--; |
michael@0 | 12 | } |
michael@0 | 13 | |
michael@0 | 14 | // Ensure that a property which is a negative integer that does not fit in a |
michael@0 | 15 | // jsval is properly *not* detected by the 'in' operator. In this case |
michael@0 | 16 | // wrongly applying INT_TO_JSID to -2147483648 will shift off the sign bit |
michael@0 | 17 | // (the only bit set in that number) and bitwise-or that value with 1, |
michael@0 | 18 | // producing jsid(1) -- which actually represents "0", not "-2147483648". |
michael@0 | 19 | // Thus 'in' will report a "-2147483648" property when none exists, because |
michael@0 | 20 | // it thinks the request was really whether the object had property "0". |
michael@0 | 21 | var obj2 = { 0: 17 }; |
michael@0 | 22 | var b = []; |
michael@0 | 23 | var index = -(1 << 28); |
michael@0 | 24 | for (var i = 0; i < 10; i++) |
michael@0 | 25 | { |
michael@0 | 26 | b.push(index in obj2); |
michael@0 | 27 | index = index - (1 << 28); |
michael@0 | 28 | } |
michael@0 | 29 | |
michael@0 | 30 | return a.join(",") + b.join(","); |
michael@0 | 31 | } |
michael@0 | 32 | |
michael@0 | 33 | assertEq(testInt32ToId(), |
michael@0 | 34 | "false,false,false,false,false,false,false,false,false,true" + |
michael@0 | 35 | "false,false,false,false,false,false,false,false,false,false"); |