From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 js/src/jit-test/tests/basic/bug656261.js | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 js/src/jit-test/tests/basic/bug656261.js

(limited to 'js/src/jit-test/tests/basic/bug656261.js')

diff --git a/js/src/jit-test/tests/basic/bug656261.js b/js/src/jit-test/tests/basic/bug656261.js
new file mode 100644
index 000000000..7a3b61d21
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug656261.js
@@ -0,0 +1,31 @@
+function build_getter(i) {
+    var x = [i];
+    return function f() { return x; }
+}
+
+function test()
+{
+    var N = internalConst("INCREMENTAL_MARK_STACK_BASE_CAPACITY") + 2;
+    var o = {};
+    var descriptor = { enumerable: true};
+    for (var i = 0; i != N; ++i) {
+	descriptor.get = build_getter(i);
+	Object.defineProperty(o, i, descriptor);
+    }
+
+    // At this point we have an object o with N getters. Each getter in turn
+    // is a closure storing an array. During the GC we push to the object
+    // marking stack all the getters found in an object after we mark it. As N
+    // exceeds the size of the object marking stack, this requires to run the
+    // dealyed scanning for some closures to mark the array objects stored in
+    // them.
+    //
+    // We run the GC twice to make sure that the background finalization
+    // finishes before we access the objects.
+    gc();
+    gc();
+    for (var i = 0; i != N; ++i)
+	assertEq(o[i][0], i);
+}
+
+test();
-- 
cgit v1.2.3