js/src/tests/non262/regress/regress-1572988-nurseryRegisterCheck.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

// |reftest| slow skip-if(!this.hasOwnProperty("oomTest"))

// Bug 1572988: Make a bunch of nursery ropes and flatten them with oomTest.
// The goal is to get an OOM while flattening that makes registering the
// string's malloc buffer with the nursery fail, triggering an assertion when
// it gets tenured.

var x = 0;
var N = 1000; // This failed most of the time on my linux64 box.

// But it can time out on the slower machines.
if (this.getBuildConfiguration &&
    (getBuildConfiguration("simulator") || getBuildConfiguration("arm") ||
     getBuildConfiguration("android"))) {
  N = 10;
}

function makeString() {
    x += 1;
    const extensible = ensureLinearString("aaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + x);
    return ensureLinearString(newRope(extensible, "bbbbbbbbbbbbbbb"));
}

function f(arr) {
    for (let i = 0; i < N; i++)
        arr.push(makeString());
    return arr;
}

var globalStore = [];
function ff() {
  globalStore.push(f([]));
}

if (this.oomTest)
  oomTest(ff);

reportCompare(true, true, "nursery malloc buffer registration failure");