From 2aa4a82499d4becd2284cdb482213d541b8804dd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 28 Apr 2024 16:29:10 +0200 Subject: Adding upstream version 86.0.1. Signed-off-by: Daniel Baumann --- .../regress/regress-1466387-worker-grayroot.js | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 js/src/tests/non262/regress/regress-1466387-worker-grayroot.js (limited to 'js/src/tests/non262/regress/regress-1466387-worker-grayroot.js') diff --git a/js/src/tests/non262/regress/regress-1466387-worker-grayroot.js b/js/src/tests/non262/regress/regress-1466387-worker-grayroot.js new file mode 100644 index 0000000000..32b74b0792 --- /dev/null +++ b/js/src/tests/non262/regress/regress-1466387-worker-grayroot.js @@ -0,0 +1,28 @@ +var BUGNUMBER = 1466387; +var summary = 'grayRoot() testing on worker thread'; + +// Before bug 1466387, the gray root tracer was not set up on worker threads, +// but the grayRoot() function was still available. This resulted in a GC +// collecting the gray root, then a read barrier firing on the dead object. +// +// This is a crashtest. If it does not crash, it will throw a ReferenceError, +// but that's ok. + +print('BUGNUMBER: ' + BUGNUMBER); +print("STATUS: " + summary); + +if (typeof 'evalInWorder' == 'function') { + evalInWorker(` + var wm = new WeakMap(); + grayRoot().map = wm; + gczeal(4,10); + evaluate(\` + grayRoot().map = __v_1173; + if (!class i { constructor() { } } ()) { + (function __f_252( get , ) {})(); + } + \`); +`); +} + +this.reportCompare && reportCompare(true, true, summary); -- cgit v1.2.3