regress-341956-02.js (1430B)
1 /* -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*- */ 2 /* This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 5 6 //----------------------------------------------------------------------------- 7 var BUGNUMBER = 341956; 8 var summary = 'GC Hazards in jsarray.c - pop'; 9 var actual = ''; 10 var expect = 'GETTER RESULT'; 11 12 //----------------------------------------------------------------------------- 13 test(); 14 //----------------------------------------------------------------------------- 15 16 function test() 17 { 18 printBugNumber(BUGNUMBER); 19 printStatus (summary); 20 21 var N = 0xFFFFFFFF; 22 var a = []; 23 a[N - 1] = 0; 24 25 var expected = "GETTER RESULT"; 26 27 a.__defineGetter__(N - 1, function() { 28 delete a[N - 1]; 29 var tmp = []; 30 tmp[N - 2] = 1; 31 32 if (typeof gc == 'function') 33 gc(); 34 for (var i = 0; i != 50000; ++i) { 35 var tmp = 1 / 3; 36 tmp /= 10; 37 } 38 for (var i = 0; i != 1000; ++i) { 39 // Make string with 11 characters that would take 40 // (11 + 1) * 2 bytes or sizeof(JSAtom) so eventually 41 // malloc will ovewrite just freed atoms. 42 var tmp2 = Array(12).join(' '); 43 } 44 return expected; 45 }); 46 47 actual = a.pop(); 48 49 reportCompare(expect, actual, summary); 50 51 print('Done'); 52 }