Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
michael@0 | 1 | function build_getter(i) { |
michael@0 | 2 | var x = [i]; |
michael@0 | 3 | return function f() { return x; } |
michael@0 | 4 | } |
michael@0 | 5 | |
michael@0 | 6 | function test() |
michael@0 | 7 | { |
michael@0 | 8 | var N = internalConst("INCREMENTAL_MARK_STACK_BASE_CAPACITY") + 2; |
michael@0 | 9 | var o = {}; |
michael@0 | 10 | var descriptor = { enumerable: true}; |
michael@0 | 11 | for (var i = 0; i != N; ++i) { |
michael@0 | 12 | descriptor.get = build_getter(i); |
michael@0 | 13 | Object.defineProperty(o, i, descriptor); |
michael@0 | 14 | } |
michael@0 | 15 | |
michael@0 | 16 | // At this point we have an object o with N getters. Each getter in turn |
michael@0 | 17 | // is a closure storing an array. During the GC we push to the object |
michael@0 | 18 | // marking stack all the getters found in an object after we mark it. As N |
michael@0 | 19 | // exceeds the size of the object marking stack, this requires to run the |
michael@0 | 20 | // dealyed scanning for some closures to mark the array objects stored in |
michael@0 | 21 | // them. |
michael@0 | 22 | // |
michael@0 | 23 | // We run the GC twice to make sure that the background finalization |
michael@0 | 24 | // finishes before we access the objects. |
michael@0 | 25 | gc(); |
michael@0 | 26 | gc(); |
michael@0 | 27 | for (var i = 0; i != N; ++i) |
michael@0 | 28 | assertEq(o[i][0], i); |
michael@0 | 29 | } |
michael@0 | 30 | |
michael@0 | 31 | test(); |