Add a test case for r214334.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 20 Oct 2017 20:08:29 +0000 (20:08 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 20 Oct 2017 20:08:29 +0000 (20:08 +0000)
https://bugs.webkit.org/show_bug.cgi?id=169941
<rdar://problem/31221258>

Reviewed by JF Bastien.

* stress/regress-169941.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@223787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/regress-169941.js [new file with mode: 0644]

index 764bcd3..9ba7363 100644 (file)
@@ -1,3 +1,13 @@
+2017-10-20  Mark Lam  <mark.lam@apple.com>
+
+        Add a test case for r214334.
+        https://bugs.webkit.org/show_bug.cgi?id=169941
+        <rdar://problem/31221258>
+
+        Reviewed by JF Bastien.
+
+        * stress/regress-169941.js: Added.
+
 2017-10-19  JF Bastien  <jfbastien@apple.com>
 
         WebAssembly: no VM / JS version of everything but Instance
diff --git a/JSTests/stress/regress-169941.js b/JSTests/stress/regress-169941.js
new file mode 100644 (file)
index 0000000..f42d8f0
--- /dev/null
@@ -0,0 +1,19 @@
+// This test should not crash.
+
+function gc() {
+    for (let i = 0; i < 0x10; i++) {
+        var a2 = new ArrayBuffer(0x1000000);
+    }
+}
+
+Array.prototype.__defineGetter__(0x1000, () => 1);
+
+gc();
+
+for (let i = 0; i < 0x100; i++) {
+    var a1 = new Array(0x100).fill(1234.5678);
+}
+
+gc();
+
+new Array(0x100).splice(0).toString();