The Tor Browser / file comparison
comparison: js/src/tests/js1_5/Array/regress-360681-02.js
js/src/tests/js1_5/Array/regress-360681-02.js
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
equal
deleted
inserted
replaced
| -1:000000000000 | 0:0fa697b870ee |
|---|---|
| 1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ | |
| 2 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 3 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 5 | |
| 6 //----------------------------------------------------------------------------- | |
| 7 var BUGNUMBER = 360681; | |
| 8 var summary = 'Regression from bug 224128'; | |
| 9 var actual = ''; | |
| 10 var expect = ''; | |
| 11 | |
| 12 | |
| 13 //----------------------------------------------------------------------------- | |
| 14 test(); | |
| 15 //----------------------------------------------------------------------------- | |
| 16 | |
| 17 function test() | |
| 18 { | |
| 19 enterFunc ('test'); | |
| 20 printBugNumber(BUGNUMBER); | |
| 21 printStatus (summary); | |
| 22 | |
| 23 expect = actual = 'No Crash'; | |
| 24 | |
| 25 var N = 1000; | |
| 26 | |
| 27 // Make an array with a hole at the end | |
| 28 var a = Array(N); | |
| 29 for (i = 0; i < N - 1; ++i) | |
| 30 a[i] = 1; | |
| 31 | |
| 32 // array_sort due for array with N elements with allocates a temporary vector | |
| 33 // with 2*N. Lets create strings that on 32 and 64 bit CPU cause allocation | |
| 34 // of the same amount of memory + 1 word for their char arrays. After we GC | |
| 35 // strings with a reasonable malloc implementation that memory will be most | |
| 36 // likely reused in array_sort for the temporary vector. Then the bug causes | |
| 37 // accessing the one-beyond-the-aloocation word and re-interpretation of | |
| 38 // 0xFFF0FFF0 as GC thing. | |
| 39 | |
| 40 var str1 = Array(2*(2*N + 1) + 1).join(String.fromCharCode(0xFFF0)); | |
| 41 var str2 = Array(4*(2*N + 1) + 1).join(String.fromCharCode(0xFFF0)); | |
| 42 gc(); | |
| 43 str1 = str2 = null; | |
| 44 gc(); | |
| 45 | |
| 46 var firstCall = true; | |
| 47 a.sort(function (a, b) { | |
| 48 if (firstCall) { | |
| 49 firstCall = false; | |
| 50 gc(); | |
| 51 } | |
| 52 return a - b; | |
| 53 }); | |
| 54 | |
| 55 reportCompare(expect, actual, summary); | |
| 56 | |
| 57 exitFunc ('test'); | |
| 58 } |
