tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

gc-05.js (1283B)


      1 // If a Debugger survives its debuggee, its object cache must still be swept.
      2 
      3 var g2arr = []; // non-debuggee globals
      4 var xarr = []; // debuggee objects
      5 
      6 var N = 4, M = 4;
      7 for (var i = 0; i < N; i++) {
      8    var g1 = newGlobal({newCompartment: true});
      9    g1.M = M;
     10    var dbg = new Debugger(g1);
     11    var g2 = g1.eval("newGlobal('same-compartment')");
     12    g1.x = g2.eval("x = {};");
     13 
     14    dbg.onDebuggerStatement = function (frame) { xarr.push(frame.eval("x").return); };
     15    g1.eval("debugger;");
     16    g2arr.push(g2);
     17 
     18    g1 = null;
     19    gc();
     20 }
     21 
     22 // At least some of the debuggees have probably been collected at this
     23 // point. It is nondeterministic, though.
     24 assertEq(g2arr.length, N);
     25 assertEq(xarr.length, N);
     26 
     27 // Try to make g2arr[i].eval eventually allocate a new object in the same
     28 // location as a previously gc'd object. If the object caches are not being
     29 // swept, the pointer coincidence will cause a Debugger.Object to be erroneously
     30 // reused.
     31 for (var i = 0; i < N; i++) {
     32    var obj = xarr[i];
     33    for (j = 0; j < M; j++) {
     34        assertEq(obj instanceof Debugger.Object, true);
     35        g2arr[i].eval("x = x.prop = {};");
     36        obj = obj.getOwnPropertyDescriptor("prop").value;;
     37        assertEq("seen" in obj, false);
     38        obj.seen = true;
     39        gc();
     40    }
     41 }