diff options
Diffstat (limited to 'js/src/jit-test/tests/structured-clone')
-rw-r--r-- | js/src/jit-test/tests/structured-clone/bug1888727.js | 21 | ||||
-rw-r--r-- | js/src/jit-test/tests/structured-clone/tenuring.js | 3 |
2 files changed, 23 insertions, 1 deletions
diff --git a/js/src/jit-test/tests/structured-clone/bug1888727.js b/js/src/jit-test/tests/structured-clone/bug1888727.js new file mode 100644 index 0000000000..7958781c92 --- /dev/null +++ b/js/src/jit-test/tests/structured-clone/bug1888727.js @@ -0,0 +1,21 @@ +function test() { + // Construct a structured clone of a random BigInt value. + const n = 0xfeeddeadbeef2dadfeeddeadbeef2dadfeeddeadbeef2dadfeeddeadbeef2dadn; + const s = serialize(n, [], {scope: 'DifferentProcess'}); + assertEq(deserialize(s), n); + + // Truncate it by chopping off the last 8 bytes. + s.clonebuffer = s.arraybuffer.slice(0, -8); + + // Deserialization should now throw a catchable exception. + try { + deserialize(s); + // The bug was throwing an uncatchable error, so this next assertion won't + // be reached in either the buggy or fixed code. + assertEq(true, false, "should have thrown truncation error"); + } catch (e) { + assertEq(e.message.includes("truncated"), true); + } +} + +test(); diff --git a/js/src/jit-test/tests/structured-clone/tenuring.js b/js/src/jit-test/tests/structured-clone/tenuring.js index 0fffa064fa..cec53a6956 100644 --- a/js/src/jit-test/tests/structured-clone/tenuring.js +++ b/js/src/jit-test/tests/structured-clone/tenuring.js @@ -1,4 +1,4 @@ -// Check that we switch to allocating in the tenure heap after the first +// Check that we switch to allocating in the tenured heap after the first // nursery collection. function buildObjectTree(depth) { @@ -82,6 +82,7 @@ function countHeapLocations(tree, objectTree, counts) { gczeal(0); gcparam('minNurseryBytes', 1024 * 1024); gcparam('maxNurseryBytes', 1024 * 1024); +gcparam('semispaceNurseryEnabled', 0); gc(); testRoundTrip(1, true, true); |