diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /js/src/tests/non262/object/clear-dictionary-accessor-getset.js | |
parent | Initial commit. (diff) | |
download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | js/src/tests/non262/object/clear-dictionary-accessor-getset.js | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/js/src/tests/non262/object/clear-dictionary-accessor-getset.js b/js/src/tests/non262/object/clear-dictionary-accessor-getset.js new file mode 100644 index 0000000000..f0d9e11ca6 --- /dev/null +++ b/js/src/tests/non262/object/clear-dictionary-accessor-getset.js @@ -0,0 +1,55 @@ +/* + * Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/licenses/publicdomain/ + */ + +var gTestfile = "clear-dictionary-accessor-getset.js"; +var BUGNUMBER = 1082662; +var summary = + "Properly handle GC of a dictionary accessor property whose [[Get]] or " + + "[[Set]] has been changed to |undefined|"; + +print(BUGNUMBER + ": " + summary); + +/************** + * BEGIN TEST * + **************/ + +function test(field) +{ + var prop = "[[" + field[0].toUpperCase() + field.substring(1) + "]]"; + print("Testing for GC crashes after setting " + prop + " to undefined..."); + + function inner() + { + // Create an object with an accessor property. + var obj = { x: 42, get y() {}, set y(v) {} }; + + // 1) convert it to dictionary mode, in the process 2) creating a new + // version of that accessor property whose [[Get]] and [[Set]] are objects + // that trigger post barriers. + delete obj.x; + + var desc = {}; + desc[field] = undefined; + + // Overwrite [[field]] with undefined. Note #1 above is necessary so this + // is an actual *overwrite*, and not (possibly) a shape-tree fork that + // doesn't overwrite. + Object.defineProperty(obj, "y", desc); + + } + + inner(); + gc(); // In unfixed code, this crashes trying to mark a null [[field]]. +} + +test("get"); +test("set"); + +/******************************************************************************/ + +if (typeof reportCompare === "function") + reportCompare(true, true); + +print("Tests complete"); |