wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1033115 - pass intermediate array as root for PJS gc for Array.prototype.reducePar. r=shu

Browse Source
This commit is contained in:
Lars T Hansen 2014-07-02 17:08:56 +02:00
parent 749d42ac21
commit b8cf55d45c
3 changed files with 35 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/builtin/Array.js
View File

@ -817,7 +817,7 @@ function ArrayReducePar(func, mode) {
var numSlices = slicesInfo.count;
var subreductions = NewDenseArray(numSlices);
ForkJoin(reduceThread, 0, numSlices, ForkJoinMode(mode), null);
ForkJoin(reduceThread, 0, numSlices, ForkJoinMode(mode), subreductions);
var accumulator = subreductions[0];
for (var i = 1; i < numSlices; i++)

21
js/src/jit-test/tests/parallel/bug1033115-2.js Normal file
View File

@ -0,0 +1,21 @@
// Failed to pass the subreductions as an assignment root to Array.prototype.reducePar,
// fuzzing test case discovered separately.
if (!getBuildConfiguration().parallelJS)
quit(0);
x = [];
y = x.mapPar(function() {});
Object.defineProperty(y, 3, {
get: (function( ... $8) {
try {
Int8Array(y);
x.reducePar(function() function q() 1);
} catch (e) {}
})
});
var x = [1,2,3];
function rsh() {
return y.toSource() >> 2.0;
}
rsh();

13
js/src/jit-test/tests/parallel/bug1033115.js Normal file
View File

@ -0,0 +1,13 @@
// Failed to pass the subreductions as an assignment root to Array.prototype.reducePar,
// fuzzing test case.
if (!getBuildConfiguration().parallelJS)
quit(0);
x = []
x[8] = ((function() {})());
for each(let a in [0, 0]) {
x.reducePar(function() {
return [0];
});
}