From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 js/src/tests/non262/Array/regress-108440.js | 77 +++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 js/src/tests/non262/Array/regress-108440.js

(limited to 'js/src/tests/non262/Array/regress-108440.js')

diff --git a/js/src/tests/non262/Array/regress-108440.js b/js/src/tests/non262/Array/regress-108440.js
new file mode 100644
index 0000000000..d83c4164ac
--- /dev/null
+++ b/js/src/tests/non262/Array/regress-108440.js
@@ -0,0 +1,77 @@
+// |reftest| skip-if(Android) -- bug - nsIDOMWindow.crypto throws NS_ERROR_NOT_IMPLEMENTED on Android
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ *
+ * Date: 30 October 2001
+ * SUMMARY: Regression test for bug 108440
+ * See http://bugzilla.mozilla.org/show_bug.cgi?id=108440
+ *
+ * We shouldn't crash trying to add an array as an element of itself (!)
+ *
+ * Brendan: "...it appears that Array.prototype.toString is unsafe,
+ * and what's more, ECMA-262 Edition 3 has no helpful words about
+ * avoiding recursive death on a cycle."
+ */
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 108440;
+var summary = "Shouldn't crash trying to add an array as an element of itself";
+var self = this;
+var temp = '';
+
+printBugNumber(BUGNUMBER);
+printStatus(summary);
+
+/*
+ * Explicit test:
+ */
+var a=[];
+temp = (a[a.length]=a);
+
+/*
+ * Implicit test (one of the properties of |self| is |a|)
+ */
+a=[];
+for(var prop in self)
+{
+  temp = prop;
+  temp = (a[a.length] = self[prop]);
+}
+
+/*
+ * Stressful explicit test
+ */
+a=[];
+for (var i=0; i<10; i++)
+{
+  a[a.length] = a;
+}
+
+/*
+ * Test toString()
+ */
+a=[];
+for (var i=0; i<10; i++)
+{
+  a[a.length] = a.toString();
+}
+
+/*
+ * Test toSource() - but Rhino doesn't have this, so try...catch it
+ */
+a=[];
+try
+{
+  for (var i=0; i<10; i++)
+  {
+    a[a.length] = a.toSource();
+  }
+}
+catch(e)
+{
+}
+
+reportCompare('No Crash', 'No Crash', '');
-- 
cgit v1.2.3