From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 21:33:14 +0200 Subject: Adding upstream version 115.7.0esr. Signed-off-by: Daniel Baumann --- .../regress/regress-1466387-worker-grayroot.js | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 js/src/tests/non262/regress/regress-1466387-worker-grayroot.js (limited to 'js/src/tests/non262/regress/regress-1466387-worker-grayroot.js') diff --git a/js/src/tests/non262/regress/regress-1466387-worker-grayroot.js b/js/src/tests/non262/regress/regress-1466387-worker-grayroot.js new file mode 100644 index 0000000000..32b74b0792 --- /dev/null +++ b/js/src/tests/non262/regress/regress-1466387-worker-grayroot.js @@ -0,0 +1,28 @@ +var BUGNUMBER = 1466387; +var summary = 'grayRoot() testing on worker thread'; + +// Before bug 1466387, the gray root tracer was not set up on worker threads, +// but the grayRoot() function was still available. This resulted in a GC +// collecting the gray root, then a read barrier firing on the dead object. +// +// This is a crashtest. If it does not crash, it will throw a ReferenceError, +// but that's ok. + +print('BUGNUMBER: ' + BUGNUMBER); +print("STATUS: " + summary); + +if (typeof 'evalInWorder' == 'function') { + evalInWorker(` + var wm = new WeakMap(); + grayRoot().map = wm; + gczeal(4,10); + evaluate(\` + grayRoot().map = __v_1173; + if (!class i { constructor() { } } ()) { + (function __f_252( get , ) {})(); + } + \`); +`); +} + +this.reportCompare && reportCompare(true, true, summary); -- cgit v1.2.3