| /* -*- Mode: java; tab-width:8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ |
| |
| /* ***** BEGIN LICENSE BLOCK ***** |
| * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
| * |
| * The contents of this file are subject to the Mozilla Public License Version |
| * 1.1 (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * http://www.mozilla.org/MPL/ |
| * |
| * Software distributed under the License is distributed on an "AS IS" basis, |
| * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License |
| * for the specific language governing rights and limitations under the |
| * License. |
| * |
| * The Original Code is JavaScript Engine testing utilities. |
| * |
| * The Initial Developer of the Original Code is |
| * Mozilla Foundation. |
| * Portions created by the Initial Developer are Copyright (C) 2006 |
| * the Initial Developer. All Rights Reserved. |
| * |
| * Contributor(s): Igor Bukanov |
| * |
| * Alternatively, the contents of this file may be used under the terms of |
| * either the GNU General Public License Version 2 or later (the "GPL"), or |
| * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), |
| * in which case the provisions of the GPL or the LGPL are applicable instead |
| * of those above. If you wish to allow use of your version of this file only |
| * under the terms of either the GPL or the LGPL, and not to allow others to |
| * use your version of this file under the terms of the MPL, indicate your |
| * decision by deleting the provisions above and replace them with the notice |
| * and other provisions required by the GPL or the LGPL. If you do not delete |
| * the provisions above, a recipient may use your version of this file under |
| * the terms of any one of the MPL, the GPL or the LGPL. |
| * |
| * ***** END LICENSE BLOCK ***** */ |
| |
| gTestfile = 'regress-352846-03.js'; |
| |
| var BUGNUMBER = 352846; |
| var summary = 'Passing unrooted value to OBJ_DEFAULT_VALUE is GC hazard'; |
| var actual = 'No Crash'; |
| var expect = 'No Crash'; |
| |
| printBugNumber(BUGNUMBER); |
| START(summary); |
| |
| var counter = 0; |
| |
| function prepare_xml() |
| { |
| delete XML.prototype.function::toString; |
| Object.prototype.toString getter = toSource_getter; |
| return new XML("<a>xml_text</a>"); |
| } |
| |
| function toSource_getter() |
| { |
| // Make sure that lastInternalResult does not contain prepare_xml |
| var tmp = { toSource: function() { return [1,2,3]; } }; |
| uneval(tmp); |
| |
| if (counter++ < 2) return undefined; |
| |
| // run GC onr overwrite the heap |
| if (typeof gc == "function") gc(); |
| var x = 1e-100; |
| for (var i = 0; i != 50000; ++i) |
| var x2 = x / 4; |
| |
| // Return a function that would access this in non-trivial way to |
| // check if prepare_xml() was rooted. |
| return function() { |
| print("xxx"); |
| return this.toXMLString(); |
| }; |
| } |
| |
| var obj = { }; |
| obj.length getter = prepare_xml; |
| Array.reverse(obj); |
| |
| TEST(1, expect, actual); |
| |
| END(); |