The Tor Browser / file comparison
comparison: js/src/jit-test/tests/basic/testInt32ToId.js
js/src/jit-test/tests/basic/testInt32ToId.js
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:bb9cc188d0c7 |
|---|---|
| 1 function testInt32ToId() | |
| 2 { | |
| 3 // Ensure that a property which is a negative integer that does not fit in a | |
| 4 // jsval is properly detected by the 'in' operator. | |
| 5 var obj = { "-1073741828": 17 }; | |
| 6 var index = -1073741819; | |
| 7 var a = []; | |
| 8 for (var i = 0; i < 10; i++) | |
| 9 { | |
| 10 a.push(index in obj); | |
| 11 index--; | |
| 12 } | |
| 13 | |
| 14 // Ensure that a property which is a negative integer that does not fit in a | |
| 15 // jsval is properly *not* detected by the 'in' operator. In this case | |
| 16 // wrongly applying INT_TO_JSID to -2147483648 will shift off the sign bit | |
| 17 // (the only bit set in that number) and bitwise-or that value with 1, | |
| 18 // producing jsid(1) -- which actually represents "0", not "-2147483648". | |
| 19 // Thus 'in' will report a "-2147483648" property when none exists, because | |
| 20 // it thinks the request was really whether the object had property "0". | |
| 21 var obj2 = { 0: 17 }; | |
| 22 var b = []; | |
| 23 var index = -(1 << 28); | |
| 24 for (var i = 0; i < 10; i++) | |
| 25 { | |
| 26 b.push(index in obj2); | |
| 27 index = index - (1 << 28); | |
| 28 } | |
| 29 | |
| 30 return a.join(",") + b.join(","); | |
| 31 } | |
| 32 | |
| 33 assertEq(testInt32ToId(), | |
| 34 "false,false,false,false,false,false,false,false,false,true" + | |
| 35 "false,false,false,false,false,false,false,false,false,false"); |
