hannesw@1355: /*
hannesw@1355:  * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved.
hannesw@1355:  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
hannesw@1355:  * 
hannesw@1355:  * This code is free software; you can redistribute it and/or modify it
hannesw@1355:  * under the terms of the GNU General Public License version 2 only, as
hannesw@1355:  * published by the Free Software Foundation.
hannesw@1355:  * 
hannesw@1355:  * This code is distributed in the hope that it will be useful, but WITHOUT
hannesw@1355:  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
hannesw@1355:  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
hannesw@1355:  * version 2 for more details (a copy is included in the LICENSE file that
hannesw@1355:  * accompanied this code).
hannesw@1355:  * 
hannesw@1355:  * You should have received a copy of the GNU General Public License version
hannesw@1355:  * 2 along with this work; if not, write to the Free Software Foundation,
hannesw@1355:  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
hannesw@1355:  * 
hannesw@1355:  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
hannesw@1355:  * or visit www.oracle.com if you need additional information or have any
hannesw@1355:  * questions.
hannesw@1355:  */
hannesw@1355: 
hannesw@1355: /**
hannesw@1355:  * JDK-8066215: Fuzzing bug: length valueOf bug
hannesw@1355:  *
hannesw@1355:  * @test
hannesw@1355:  * @run
hannesw@1355:  */
hannesw@1355: 
hannesw@1355: function defineLength(arr, length) {
hannesw@1355:     Object.defineProperty(arr, "length", {
hannesw@1355:         value: {
hannesw@1355:             valueOf: function() {
hannesw@1355:                 print("value retrieved: " + length);
hannesw@1355:                 return length;
hannesw@1355:             }
hannesw@1355:         }
hannesw@1355:     });
hannesw@1355:     print("done: " + arr.length + ", " + typeof arr.length);
hannesw@1355: }
hannesw@1355: 
hannesw@1355: var a = [];
hannesw@1355: defineLength(a, 3);
hannesw@1355: defineLength(a, 6);
hannesw@1355: defineLength(a, 3);