regress-1572988-nurseryRegisterCheck.js (1063B)
1 // |reftest| slow skip-if(!this.hasOwnProperty("oomTest")) 2 3 // Bug 1572988: Make a bunch of nursery ropes and flatten them with oomTest. 4 // The goal is to get an OOM while flattening that makes registering the 5 // string's malloc buffer with the nursery fail, triggering an assertion when 6 // it gets tenured. 7 8 var x = 0; 9 var N = 1000; // This failed most of the time on my linux64 box. 10 11 // But it can time out on the slower machines. 12 if (this.getBuildConfiguration && 13 (getBuildConfiguration("simulator") || getBuildConfiguration("arm") || 14 getBuildConfiguration("android"))) { 15 N = 10; 16 } 17 18 function makeString() { 19 x += 1; 20 const extensible = ensureLinearString("aaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + x); 21 return ensureLinearString(newRope(extensible, "bbbbbbbbbbbbbbb")); 22 } 23 24 function f(arr) { 25 for (let i = 0; i < N; i++) 26 arr.push(makeString()); 27 return arr; 28 } 29 30 var globalStore = []; 31 function ff() { 32 globalStore.push(f([])); 33 } 34 35 if (this.oomTest) 36 oomTest(ff); 37 38 reportCompare(true, true, "nursery malloc buffer registration failure");