tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug656261.js (951B)


      1 function build_getter(i) {
      2    var x = [i];
      3    return function f() { return x; }
      4 }
      5 
      6 function test()
      7 {
      8    var N = internalConst("MARK_STACK_BASE_CAPACITY") + 2;
      9    var o = {};
     10    var descriptor = { enumerable: true};
     11    for (var i = 0; i != N; ++i) {
     12 descriptor.get = build_getter(i);
     13 Object.defineProperty(o, i, descriptor);
     14    }
     15 
     16    // At this point we have an object o with N getters. Each getter in turn
     17    // is a closure storing an array. During the GC we push to the object
     18    // marking stack all the getters found in an object after we mark it. As N
     19    // exceeds the size of the object marking stack, this requires to run the
     20    // dealyed scanning for some closures to mark the array objects stored in
     21    // them.
     22    //
     23    // We run the GC twice to make sure that the background finalization
     24    // finishes before we access the objects.
     25    gc();
     26    gc();
     27    for (var i = 0; i != N; ++i)
     28 assertEq(o[i][0], i);
     29 }
     30 
     31 test();