The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/jit-test/tests/debug/gc-05.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,41 @@
     1.4 +// If a Debugger survives its debuggee, its object cache must still be swept.
     1.5 +
     1.6 +var g2arr = []; // non-debuggee globals
     1.7 +var xarr = []; // debuggee objects
     1.8 +
     1.9 +var N = 4, M = 4;
    1.10 +for (var i = 0; i < N; i++) {
    1.11 +    var g1 = newGlobal();
    1.12 +    g1.M = M;
    1.13 +    var dbg = new Debugger(g1);
    1.14 +    var g2 = g1.eval("newGlobal('same-compartment')");
    1.15 +    g1.x = g2.eval("x = {};");
    1.16 +
    1.17 +    dbg.onDebuggerStatement = function (frame) { xarr.push(frame.eval("x").return); };
    1.18 +    g1.eval("debugger;");
    1.19 +    g2arr.push(g2);
    1.20 +
    1.21 +    g1 = null;
    1.22 +    gc();
    1.23 +}
    1.24 +
    1.25 +// At least some of the debuggees have probably been collected at this
    1.26 +// point. It is nondeterministic, though.
    1.27 +assertEq(g2arr.length, N);
    1.28 +assertEq(xarr.length, N);
    1.29 +
    1.30 +// Try to make g2arr[i].eval eventually allocate a new object in the same
    1.31 +// location as a previously gc'd object. If the object caches are not being
    1.32 +// swept, the pointer coincidence will cause a Debugger.Object to be erroneously
    1.33 +// reused.
    1.34 +for (var i = 0; i < N; i++) {
    1.35 +    var obj = xarr[i];
    1.36 +    for (j = 0; j < M; j++) {
    1.37 +        assertEq(obj instanceof Debugger.Object, true);
    1.38 +        g2arr[i].eval("x = x.prop = {};");
    1.39 +        obj = obj.getOwnPropertyDescriptor("prop").value;;
    1.40 +        assertEq("seen" in obj, false);
    1.41 +        obj.seen = true;
    1.42 +        gc();
    1.43 +    }
    1.44 +}