third_party/WebKit/LayoutTests/inspector/sources/debugger/debugger-activation-crash.html

   1 <script src="../../../http/tests/inspector/inspector-test.js"></script>
   2 <script src="../../../http/tests/inspector/debugger-test.js"></script>
   3
   4 <script>
   5 var closures = [];
   6 function makeClosure() {
   7     var v1, v2, v3, v4, v5, v6, v7, v8, v9, v10; // Make a lot of potentially captured variables.
   8     return function (){ return v1; }; // But only capture one in optimizing compiles.
   9 }
  10
  11 for (var i = 0; i < 100; ++i) {
  12     closures.push(makeClosure());
  13 }
  14
  15 function tryCrash() {
  16     makeClosure(); // Force recompilation.
  17
  18     // At this point, we should have 100 activations that captured 1 variable
  19     // but think they captured 10. If so, GC should make them crash.
  20     if (window.GCController)
  21         GCController.collect();
  22     else {
  23         for (var i = 0; i < 10000; ++i)
  24             new Object;
  25     }
  26 }
  27
  28 function test() {
  29     InspectorTest.startDebuggerTest(function () {
  30         InspectorTest.evaluateInPage("tryCrash()");
  31         InspectorTest.completeDebuggerTest();
  32     });
  33 }
  34
  35 window.onload = runTest;
  36 </script>
  37
  38 <p>
  39 Tests for a crash caused by inaccurate Activation records.
  40 &lt;rdar://problem/8525907&gt; Crash in debugger beneath MarkStack::drain @ me.com, ibm.com
  41 </p>
  42