bug620694.js 1.1 KB

123456789101112131415161718192021222324252627
  1. //-------------------------------------------------------------------------------------------------------
  2. // Copyright (C) Microsoft. All rights reserved.
  3. // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
  4. //-------------------------------------------------------------------------------------------------------
  5. // OS: Bug 620694: Assertion when evaluating 'new Map();' in F12
  6. //
  7. // Object.toString() incorrectly returns Var from temporary allocator.
  8. //
  9. // Run with: -es6all (To make it more likely to repro, add -recyclerstress)
  10. //
  11. /// <reference path="../UnitTestFramework/UnitTestFramework.js" />
  12. WScript.LoadScriptFile("..\\UnitTestFramework\\UnitTestFramework.js");
  13. // Bug: "x" is from temp allocator. Supposed to contain string "[object Map]".
  14. var x = (new Map()).toString();
  15. // Try to overwrite memory of "x" with other similar Vars also from temp allocator, "[object Set]".
  16. for (var i = 0; i < 10; i++) {
  17. var tmp = new Set();
  18. tmp = tmp.toString();
  19. }
  20. assert.areEqual("[object Map]", x);
  21. WScript.Echo("pass");