The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/tests/js1_8_5/regress/regress-592556-c35.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,20 @@
     1.4 +// Any copyright is dedicated to the Public Domain.
     1.5 +// http://creativecommons.org/licenses/publicdomain/
     1.6 +// Contributor: Jason Orendorff <jorendorff@mozilla.com>
     1.7 +
     1.8 +var obj = {a: 0, b: 1, c: 2};
     1.9 +delete obj.b;  // switch to dictionary mode
    1.10 +Object.defineProperty(obj, 'g',
    1.11 +                      {get: function () { return -1; }, configurable: true});
    1.12 +for (var i = 3; i < 20; i++)
    1.13 +    obj['x' + i] = i;  // get property table
    1.14 +for (var i = 3; i < 20; i++)
    1.15 +    delete obj['x' + i];  // add to freelist
    1.16 +delete obj.g;  // must update lastProp->freeslot, to avoid assertion
    1.17 +
    1.18 +// extra junk to try to hit the assertion, if freeslot is not updated
    1.19 +gc();
    1.20 +obj.d = 3;
    1.21 +obj.e = 4;
    1.22 +
    1.23 +reportCompare(0, 0, 'ok');