depended-on-bit-2.js (1298B)
1 var dependedOnStrings = []; 2 3 var length = 50; 4 var reg = /q[a0-9]{50}/; 5 6 function getSubstr(src, i) { 7 return reg.exec(src)[0]; 8 } 9 10 function checkProp(o, prop) { 11 return o[prop]; 12 } 13 14 var substrs = []; 15 var objs = []; 16 17 with({}) 18 for (var i = 0; i < 1000; i++) { 19 var pieces = []; 20 for (var j = 0; j < 99; j++) { 21 if (j == (i * 2) % 50) { 22 pieces.push("q"); 23 } 24 pieces.push("a"); 25 pieces.push(Math.floor(Math.random() * 10)); 26 } 27 dependedOnStrings.push(pieces.join("")); 28 } 29 30 for (var i = 0; i < 1000; i++) { 31 // Create a bunch of substrings depending on strings in dependedOnStrings 32 substrs.push(getSubstr(dependedOnStrings[i], (i * 2) % 50)); 33 objs.push({}); 34 } 35 36 for (var i = 0; i < 1000; i++) { 37 // Use the depended on strings as keys to get them replaced with 38 // JSAtomRefStrings 39 checkProp(objs[i], dependedOnStrings[i]); 40 } 41 42 // Use a bunch of memory to try to ensure that we overwrite the buffers 43 // that could have erroneously been freed 44 for (var i = 0; i < 1000; i++) { 45 var pieces = []; 46 for (var j = 0; j < 99; j++) { 47 pieces.push("b"); 48 pieces.push(Math.floor(Math.random() * 10)); 49 } 50 dependedOnStrings.push(pieces.join("")); 51 } 52 53 // Ensure the buffers were not in fact freed 54 for (var i = 0; i < 1000; i++) { 55 assertEq(substrs[i].startsWith("qa"), true); 56 }