regress-355410.js (1203B)
1 /* -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*- */ 2 /* This Source Code Form is subject to the terms of the Mozilla Public 3 * License, v. 2.0. If a copy of the MPL was not distributed with this 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 5 6 //----------------------------------------------------------------------------- 7 var BUGNUMBER = 355410; 8 var summary = 'GC hazard in for([k,v] in o){...}'; 9 var actual = 'No Crash'; 10 var expect = 'No Crash'; 11 12 13 //----------------------------------------------------------------------------- 14 test(); 15 //----------------------------------------------------------------------------- 16 17 function test() 18 { 19 printBugNumber(BUGNUMBER); 20 printStatus (summary); 21 22 var address = 0xbadf00d0, basket = { food: {} }; 23 var AP = Array.prototype, rooter = {}; 24 AP.__defineGetter__(0, function() { return this[-1]; }); 25 AP.__defineSetter__(0, function(v) { 26 basket.food = null; 27 for(var i = 0; i < 8 * 1024; i++) { 28 rooter[i] = 0x10000000000000 + address; // IEEE754! 29 } 30 return this[-1] = v; 31 }); 32 for(var [key, value] in basket) { value.trigger; } 33 34 delete Array.prototype[0]; 35 36 reportCompare(expect, actual, summary); 37 }