Title: [209203] trunk/JSTests
- Revision
- 209203
- Author
- gga...@apple.com
- Date
- 2016-12-01 13:58:30 -0800 (Thu, 01 Dec 2016)
Log Message
Land a test case for <rdar://problem/27889416>
https://bugs.webkit.org/show_bug.cgi?id=165272
Reviewed by Saam Barati.
* stress/marked-argument-buffer.js: Added.
(allocate):
(test.o.toString):
(test):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (209202 => 209203)
--- trunk/JSTests/ChangeLog 2016-12-01 21:57:33 UTC (rev 209202)
+++ trunk/JSTests/ChangeLog 2016-12-01 21:58:30 UTC (rev 209203)
@@ -1,3 +1,15 @@
+2016-12-01 Geoffrey Garen <gga...@apple.com>
+
+ Land a test case for <rdar://problem/27889416>
+ https://bugs.webkit.org/show_bug.cgi?id=165272
+
+ Reviewed by Saam Barati.
+
+ * stress/marked-argument-buffer.js: Added.
+ (allocate):
+ (test.o.toString):
+ (test):
+
2016-11-29 Per Arne Vollan <pvol...@apple.com>
[Win] Skip failing JSC tests.
Added: trunk/JSTests/stress/marked-argument-buffer.js (0 => 209203)
--- trunk/JSTests/stress/marked-argument-buffer.js (rev 0)
+++ trunk/JSTests/stress/marked-argument-buffer.js 2016-12-01 21:58:30 UTC (rev 209203)
@@ -0,0 +1,96 @@
+// Regression test for <rdar://problem/27889416>.
+
+function allocate() {
+ var i = 0;
+ var array = new Array(17);
+ for ( ; i < array.length; i++)
+ array[i] = new Uint32Array(0x00040000);
+ i = 0;
+ var arr = [];
+ arr.xxx = "xxx";
+ for (var i = 0; i < 1024; i++) {
+ arr[i] = new Array(i);
+ arr[i].xxx = "xxx " + i
+ }
+
+ if (this.gc)
+ this.gc();
+}
+
+function test() {
+ var array = new Array(256);
+ var targetReference = [];
+ var keepAlive = null;
+
+ for (var x = 0; x < array.length; x++) {
+ if (x == array.length / 4) {
+ keepAlive = new Array(2047);
+ targetReference.shift();
+ }
+
+ array[x] = new Array(4095);
+ }
+
+ var o = {};
+ var l = 0;
+ o.toString = function() {
+ if (0 == l) {
+ keepAlive = null;
+ targetReference = null;
+ obj.prop.value = null;
+ allocate();
+ }
+ l += 1;
+ return 10;
+ };
+ var obj = {
+ x0 : {
+ value : 0
+ },
+ x1 : {
+ value : 0
+ },
+ x2 : {
+ value : 0
+ },
+ x3 : {
+ value : 0
+ },
+ x4 : {
+ value : 0
+ },
+ x5 : {
+ value : 0
+ },
+ x6 : {
+ value : 0
+ },
+ x7 : {
+ value : 0
+ },
+ x8 : {
+ value : 0
+ },
+ x9 : {
+ value : 0
+ },
+ x10 : {
+ value : 0
+ },
+ length : {
+ value : o
+ },
+ prop : {
+ value : targetReference
+ },
+ beast : {
+ value : 0
+ }
+ };
+ var array2 = [];
+ var expectedLength = targetReference.length
+ Object.defineProperties(array2, obj);
+ if (array2.prop.length != expectedLength)
+ throw "fail";
+}
+test();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
