diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
commit | 2aa4a82499d4becd2284cdb482213d541b8804dd (patch) | |
tree | b80bf8bf13c3766139fbacc530efd0dd9d54394c /js/src/jit-test/tests/ion/bug858586.js | |
parent | Initial commit. (diff) | |
download | firefox-upstream.tar.xz firefox-upstream.zip |
Adding upstream version 86.0.1.upstream/86.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | js/src/jit-test/tests/ion/bug858586.js | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug858586.js b/js/src/jit-test/tests/ion/bug858586.js new file mode 100644 index 0000000000..73e10872d4 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug858586.js @@ -0,0 +1,30 @@ +// This test case was created before %TypedArrayPrototype%.toString was +// implemented. Now that we've got %TypedArrayPrototype%.toString the test will +// attempt to create a 300300001 character long string and either timeout or +// throw an oom error. Restore the original behavior by replacing toString with +// Object.prototype.toString. +Uint8ClampedArray.prototype.toString = Object.prototype.toString; + +function A(a) { this.a = a; } +A.prototype.foo = function (x) {}; +function B(b) { this.b = b; } +B.prototype.foo = function (x) {}; +function C(c) {} +function makeArray(n) { + var classes = [A, B, C]; + var arr = []; + for (var i = 0; i < n; i++) { + arr.push(new classes[i % 3](i % 3)); + } + return arr; +} +function runner(arr, resultArray, len) { + for (var i = 0; i < len; i++) { + var obj = arr[i]; + resultArray[0] += new obj.foo(i); + } +} +var resultArray = [0]; +var arr = makeArray(30000); +C.prototype.foo = Uint8ClampedArray; +runner(arr, resultArray, 30000); |