/* * Any copyright is dedicated to the Public Domain. * http://creativecommons.org/licenses/publicdomain/ */ var gTestfile = "clear-dictionary-accessor-getset.js"; var BUGNUMBER = 1082662; var summary = "Properly handle GC of a dictionary accessor property whose [[Get]] or " + "[[Set]] has been changed to |undefined|"; print(BUGNUMBER + ": " + summary); /************** * BEGIN TEST * **************/ function test(field) { var prop = "[[" + field[0].toUpperCase() + field.substring(1) + "]]"; print("Testing for GC crashes after setting " + prop + " to undefined..."); function inner() { // Create an object with an accessor property. var obj = { x: 42, get y() {}, set y(v) {} }; // 1) convert it to dictionary mode, in the process 2) creating a new // version of that accessor property whose [[Get]] and [[Set]] are objects // that trigger post barriers. delete obj.x; var desc = {}; desc[field] = undefined; // Overwrite [[field]] with undefined. Note #1 above is necessary so this // is an actual *overwrite*, and not (possibly) a shape-tree fork that // doesn't overwrite. Object.defineProperty(obj, "y", desc); } inner(); gc(); // In unfixed code, this crashes trying to mark a null [[field]]. } test("get"); test("set"); /******************************************************************************/ if (typeof reportCompare === "function") reportCompare(true, true); print("Tests complete");