regress-341956-03.js (1754B)
1 /* -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*- */ 2 /* This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 5 6 //----------------------------------------------------------------------------- 7 var BUGNUMBER = 341956; 8 var summary = 'GC Hazards in jsarray.c - reverse'; 9 var actual = 'No Crash'; 10 var expect = 'No Crash'; 11 12 //----------------------------------------------------------------------------- 13 test(); 14 //----------------------------------------------------------------------------- 15 16 function test() 17 { 18 printBugNumber(BUGNUMBER); 19 printStatus (summary); 20 21 var N = 0xFFFFFFFF; 22 var a = []; 23 a[N - 1] = 0; 24 25 var expected = "GETTER RESULT"; 26 27 a.__defineGetter__(N - 1, function() { 28 delete a[N - 1]; 29 var tmp = []; 30 tmp[N - 2] = 1; 31 32 if (typeof gc == 'function') 33 gc(); 34 for (var i = 0; i != 50000; ++i) { 35 var tmp = 1 / 3; 36 tmp /= 10; 37 } 38 for (var i = 0; i != 1000; ++i) { 39 // Make string with 11 characters that would take 40 // (11 + 1) * 2 bytes or sizeof(JSAtom) so eventually 41 // malloc will ovewrite just freed atoms. 42 var tmp2 = Array(12).join(' '); 43 } 44 return expected; 45 }); 46 47 // The following always-throw getter is to stop unshift from doing 48 // 2^32 iterations. 49 var toStop = "stringToStop"; 50 a[N - 3] = 0; 51 a.__defineGetter__(N - 3, function() { throw toStop; }); 52 53 54 var good = false; 55 56 try { 57 a.reverse(); 58 } catch (e) { 59 if (e === toStop) 60 good = true; 61 } 62 63 expect = true; 64 actual = good; 65 66 reportCompare(expect, actual, summary); 67 68 print('Done'); 69 }