blob: f0d9e11ca6c56485e117fd068a827d40da665ac5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
/*
* Any copyright is dedicated to the Public Domain.
* http://creativecommons.org/licenses/publicdomain/
*/
var gTestfile = "clear-dictionary-accessor-getset.js";
var BUGNUMBER = 1082662;
var summary =
"Properly handle GC of a dictionary accessor property whose [[Get]] or " +
"[[Set]] has been changed to |undefined|";
print(BUGNUMBER + ": " + summary);
/**************
* BEGIN TEST *
**************/
function test(field)
{
var prop = "[[" + field[0].toUpperCase() + field.substring(1) + "]]";
print("Testing for GC crashes after setting " + prop + " to undefined...");
function inner()
{
// Create an object with an accessor property.
var obj = { x: 42, get y() {}, set y(v) {} };
// 1) convert it to dictionary mode, in the process 2) creating a new
// version of that accessor property whose [[Get]] and [[Set]] are objects
// that trigger post barriers.
delete obj.x;
var desc = {};
desc[field] = undefined;
// Overwrite [[field]] with undefined. Note #1 above is necessary so this
// is an actual *overwrite*, and not (possibly) a shape-tree fork that
// doesn't overwrite.
Object.defineProperty(obj, "y", desc);
}
inner();
gc(); // In unfixed code, this crashes trying to mark a null [[field]].
}
test("get");
test("set");
/******************************************************************************/
if (typeof reportCompare === "function")
reportCompare(true, true);
print("Tests complete");
|
