From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 02:47:55 +0200 Subject: Adding upstream version 124.0.1. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/ion/bug858586.js | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 js/src/jit-test/tests/ion/bug858586.js (limited to 'js/src/jit-test/tests/ion/bug858586.js') diff --git a/js/src/jit-test/tests/ion/bug858586.js b/js/src/jit-test/tests/ion/bug858586.js new file mode 100644 index 0000000000..73e10872d4 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug858586.js @@ -0,0 +1,30 @@ +// This test case was created before %TypedArrayPrototype%.toString was +// implemented. Now that we've got %TypedArrayPrototype%.toString the test will +// attempt to create a 300300001 character long string and either timeout or +// throw an oom error. Restore the original behavior by replacing toString with +// Object.prototype.toString. +Uint8ClampedArray.prototype.toString = Object.prototype.toString; + +function A(a) { this.a = a; } +A.prototype.foo = function (x) {}; +function B(b) { this.b = b; } +B.prototype.foo = function (x) {}; +function C(c) {} +function makeArray(n) { + var classes = [A, B, C]; + var arr = []; + for (var i = 0; i < n; i++) { + arr.push(new classes[i % 3](i % 3)); + } + return arr; +} +function runner(arr, resultArray, len) { + for (var i = 0; i < len; i++) { + var obj = arr[i]; + resultArray[0] += new obj.foo(i); + } +} +var resultArray = [0]; +var arr = makeArray(30000); +C.prototype.foo = Uint8ClampedArray; +runner(arr, resultArray, 30000); -- cgit v1.2.3