blob: 3b35f90abc8ef7139f28d475241984e89588aeef (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
// |reftest| skip-if(!xulRuntime.shell)
/* -*- Mode: js2; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/*
* Any copyright is dedicated to the Public Domain.
* https://creativecommons.org/publicdomain/zero/1.0/
*/
// Deserialize a serialization buffer containing a reference to a
// SharedArrayBuffer buffer object enough times and we will crash because of a
// reference counting bug.
if (!this.SharedArrayBuffer) {
reportCompare(true,true);
quit(0);
}
let x = new SharedArrayBuffer(1);
let y = serialize(x, [], {SharedArrayBuffer: 'allow'});
x = null;
// If the bug is present this loop usually crashes quickly during
// deserialization because the memory has become unmapped.
for (let i=0 ; i < 50 ; i++ ) {
let obj = deserialize(y, {SharedArrayBuffer: 'allow'});
let z = new Int8Array(obj);
z[0] = 0;
}
reportCompare(true, true);
|
