summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/ion/bug858586.js
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-28 14:29:10 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-28 14:29:10 +0000
commit2aa4a82499d4becd2284cdb482213d541b8804dd (patch)
treeb80bf8bf13c3766139fbacc530efd0dd9d54394c /js/src/jit-test/tests/ion/bug858586.js
parentInitial commit. (diff)
downloadfirefox-upstream.tar.xz
firefox-upstream.zip
Adding upstream version 86.0.1.upstream/86.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--js/src/jit-test/tests/ion/bug858586.js30
1 files changed, 30 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug858586.js b/js/src/jit-test/tests/ion/bug858586.js
new file mode 100644
index 0000000000..73e10872d4
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug858586.js
@@ -0,0 +1,30 @@
+// This test case was created before %TypedArrayPrototype%.toString was
+// implemented. Now that we've got %TypedArrayPrototype%.toString the test will
+// attempt to create a 300300001 character long string and either timeout or
+// throw an oom error. Restore the original behavior by replacing toString with
+// Object.prototype.toString.
+Uint8ClampedArray.prototype.toString = Object.prototype.toString;
+
+function A(a) { this.a = a; }
+A.prototype.foo = function (x) {};
+function B(b) { this.b = b; }
+B.prototype.foo = function (x) {};
+function C(c) {}
+function makeArray(n) {
+ var classes = [A, B, C];
+ var arr = [];
+ for (var i = 0; i < n; i++) {
+ arr.push(new classes[i % 3](i % 3));
+ }
+ return arr;
+}
+function runner(arr, resultArray, len) {
+ for (var i = 0; i < len; i++) {
+ var obj = arr[i];
+ resultArray[0] += new obj.foo(i);
+ }
+}
+var resultArray = [0];
+var arr = makeArray(30000);
+C.prototype.foo = Uint8ClampedArray;
+runner(arr, resultArray, 30000);