regress-341956-01.js (1687B)
1 /* -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*- */ 2 /* This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 5 6 //----------------------------------------------------------------------------- 7 var BUGNUMBER = 341956; 8 var summary = 'GC Hazards in jsarray.c - unshift'; 9 var actual = 'No Crash'; 10 var expect = 'No Crash'; 11 12 //----------------------------------------------------------------------------- 13 test(); 14 //----------------------------------------------------------------------------- 15 16 function test() 17 { 18 printBugNumber(BUGNUMBER); 19 printStatus (summary); 20 21 var N = 0xFFFFFFFF; 22 23 var a = []; 24 a[N - 1] = 1; 25 a.__defineGetter__(N - 1, function() { 26 var tmp = []; 27 tmp[N - 2] = 0; 28 if (typeof gc == 'function') 29 gc(); 30 for (var i = 0; i != 50000; ++i) { 31 var tmp = 1 / 3; 32 tmp /= 10; 33 } 34 for (var i = 0; i != 1000; ++i) { 35 // Make string with 11 characters that would take 36 // (11 + 1) * 2 bytes or sizeof(JSAtom) so eventually 37 // malloc will ovewrite just freed atoms. 38 var tmp2 = Array(12).join(' '); 39 } 40 return 10; 41 }); 42 43 44 // The following always-throw getter is to stop unshift from doing 45 // 2^32 iterations. 46 var toStop = "stringToStop"; 47 a[N - 3] = 0; 48 a.__defineGetter__(N - 3, function() { throw toStop; }); 49 50 var good = false; 51 52 try { 53 a.unshift(1); 54 } catch (e) { 55 if (e === toStop) 56 good = true; 57 } 58 59 expect = true; 60 actual = good; 61 62 reportCompare(expect, actual, summary); 63 64 print('Done'); 65 }