summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/gc/oomInArrayProtoTest.js
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--js/src/jit-test/tests/gc/oomInArrayProtoTest.js22
1 files changed, 22 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/gc/oomInArrayProtoTest.js b/js/src/jit-test/tests/gc/oomInArrayProtoTest.js
new file mode 100644
index 0000000000..b99669d92d
--- /dev/null
+++ b/js/src/jit-test/tests/gc/oomInArrayProtoTest.js
@@ -0,0 +1,22 @@
+// |jit-test| skip-if: !('oomTest' in this)
+
+function arrayProtoOutOfRange() {
+ function f(obj) {
+ return typeof obj[15];
+ }
+
+ function test() {
+ var a = [1, 2];
+ a.__proto__ = {15: 1337};
+ var b = [1, 2, 3, 4];
+
+ for (var i = 0; i < 200; i++) {
+ var r = f(i % 2 ? a : b);
+ assertEq(r, i % 2 ? "number" : "undefined");
+ }
+ }
+
+ test();
+}
+
+oomTest(arrayProtoOutOfRange);