regress-311792-02.js (930B)
1 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ 2 /* This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 5 6 //----------------------------------------------------------------------------- 7 var BUGNUMBER = 311792; 8 var summary = 'Root Array.prototype methods'; 9 var actual = 'No Crash'; 10 var expect = 'No Crash'; 11 12 printBugNumber(BUGNUMBER); 13 printStatus (summary); 14 15 var subverted = 0; 16 17 function index_getter() 18 { 19 delete a[0]; 20 gc(); 21 for (var i = 0; i != 1 << 14; ++i) { 22 var tmp = new String("test"); 23 tmp = null; 24 } 25 return 1; 26 } 27 28 function index_setter(value) 29 { 30 subverted = value; 31 } 32 33 var a = [ Math.sqrt(2), 0 ]; 34 a.__defineGetter__(1, index_getter); 35 a.__defineSetter__(1, index_setter); 36 37 a.reverse(); 38 printStatus(subverted) 39 40 reportCompare(expect, actual, summary);