js/src/tests/js1_5/Array/regress-360681-02.js@b8a032363ba2 (annotated)
js/src/tests/js1_5/Array/regress-360681-02.js
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ |
| michael@0 | 2 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 3 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 4 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 5 | |
| michael@0 | 6 | //----------------------------------------------------------------------------- |
| michael@0 | 7 | var BUGNUMBER = 360681; |
| michael@0 | 8 | var summary = 'Regression from bug 224128'; |
| michael@0 | 9 | var actual = ''; |
| michael@0 | 10 | var expect = ''; |
| michael@0 | 11 | |
| michael@0 | 12 | |
| michael@0 | 13 | //----------------------------------------------------------------------------- |
| michael@0 | 14 | test(); |
| michael@0 | 15 | //----------------------------------------------------------------------------- |
| michael@0 | 16 | |
| michael@0 | 17 | function test() |
| michael@0 | 18 | { |
| michael@0 | 19 | enterFunc ('test'); |
| michael@0 | 20 | printBugNumber(BUGNUMBER); |
| michael@0 | 21 | printStatus (summary); |
| michael@0 | 22 | |
| michael@0 | 23 | expect = actual = 'No Crash'; |
| michael@0 | 24 | |
| michael@0 | 25 | var N = 1000; |
| michael@0 | 26 | |
| michael@0 | 27 | // Make an array with a hole at the end |
| michael@0 | 28 | var a = Array(N); |
| michael@0 | 29 | for (i = 0; i < N - 1; ++i) |
| michael@0 | 30 | a[i] = 1; |
| michael@0 | 31 | |
| michael@0 | 32 | // array_sort due for array with N elements with allocates a temporary vector |
| michael@0 | 33 | // with 2*N. Lets create strings that on 32 and 64 bit CPU cause allocation |
| michael@0 | 34 | // of the same amount of memory + 1 word for their char arrays. After we GC |
| michael@0 | 35 | // strings with a reasonable malloc implementation that memory will be most |
| michael@0 | 36 | // likely reused in array_sort for the temporary vector. Then the bug causes |
| michael@0 | 37 | // accessing the one-beyond-the-aloocation word and re-interpretation of |
| michael@0 | 38 | // 0xFFF0FFF0 as GC thing. |
| michael@0 | 39 | |
| michael@0 | 40 | var str1 = Array(2*(2*N + 1) + 1).join(String.fromCharCode(0xFFF0)); |
| michael@0 | 41 | var str2 = Array(4*(2*N + 1) + 1).join(String.fromCharCode(0xFFF0)); |
| michael@0 | 42 | gc(); |
| michael@0 | 43 | str1 = str2 = null; |
| michael@0 | 44 | gc(); |
| michael@0 | 45 | |
| michael@0 | 46 | var firstCall = true; |
| michael@0 | 47 | a.sort(function (a, b) { |
| michael@0 | 48 | if (firstCall) { |
| michael@0 | 49 | firstCall = false; |
| michael@0 | 50 | gc(); |
| michael@0 | 51 | } |
| michael@0 | 52 | return a - b; |
| michael@0 | 53 | }); |
| michael@0 | 54 | |
| michael@0 | 55 | reportCompare(expect, actual, summary); |
| michael@0 | 56 | |
| michael@0 | 57 | exitFunc ('test'); |
| michael@0 | 58 | } |
