clear-dictionary-accessor-getset.js

Enable keyboard shortcuts

/*

 * Any copyright is dedicated to the Public Domain.

 * http://creativecommons.org/licenses/publicdomain/

*/

var gTestfile = "clear-dictionary-accessor-getset.js";

var BUGNUMBER = 1082662;

var summary =

  "Properly handle GC of a dictionary accessor property whose [[Get]] or " +

  "[[Set]] has been changed to |undefined|";

print(BUGNUMBER + ": " + summary);

/**************

 * BEGIN TEST *

 **************/

function test(field)

  var prop = "[[" + field[0].toUpperCase() + field.substring(1) + "]]";

  print("Testing for GC crashes after setting " + prop + " to undefined...");

  function inner()

     // Create an object with an accessor property.

     var obj = { x: 42, get y() {}, set y(v) {} };

     // 1) convert it to dictionary mode, in the process 2) creating a new

     // version of that accessor property whose [[Get]] and [[Set]] are objects

     // that trigger post barriers.

     delete obj.x;

     var desc = {};

     desc[field] = undefined;

     // Overwrite [[field]] with undefined.  Note #1 above is necessary so this

     // is an actual *overwrite*, and not (possibly) a shape-tree fork that

     // doesn't overwrite.

     Object.defineProperty(obj, "y", desc);

  inner();

  gc(); // In unfixed code, this crashes trying to mark a null [[field]].

test("get");

test("set");

/******************************************************************************/

if (typeof reportCompare === "function")

  reportCompare(true, true);

print("Tests complete");