1 files changed, 44 insertions, 0 deletions
diff --git a/js/src/tests/js1_8/extensions/regress-415721.js b/js/src/tests/js1_8/extensions/regress-415721.js
new file mode 100644
index 000000000..b5f66f779
--- /dev/null
+++ b/js/src/tests/js1_8/extensions/regress-415721.js
@@ -0,0 +1,44 @@
+// |reftest| skip
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 415721;
+var summary = 'jsatom.c double hashing re-validation logic is unsound';
+
+printStatus (summary);
+
+var VARS = 10000;
+var TRIES = 100;
+
+function atomizeStressTest() {
+  var fn = "function f() {var ";
+  for (var i = 0; i < VARS; i++)
+    fn += '_f' + i + ', ';
+  fn += 'q;}';
+
+  function e() { eval(fn); }
+
+  for (var i = 0; i < TRIES; i++) {
+    scatter([e,e]);
+    gc();
+  }
+}
+
+var expect;
+var actual;
+
+expect = actual = 'No crash';
+if (typeof scatter == 'undefined' || typeof gc == 'undefined') {
+  print('Test skipped. scatter or gc not defined.');
+  expect = actual = 'Test skipped.';
+} else {
+  atomizeStressTest();
+}
+
+reportCompare(expect, actual, summary);
+