--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/WebCore/manual-tests/array-out-of-memory.html Fri Sep 17 09:02:29 2010 +0300
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script>
+
+function runArrayOOMTest() {
+ document.write("<p>Starting test...</p>");
+
+ // The index 'target' is the location in the array we expect to fault on access, should the size calculation of the realloc of the vector be allowed
+ // to overflow. The vector needs to be ((target + 1) * sizeof(JSValue*)) bytes long to hold 'target', or approximately 2/3 UINT32_MAX. Upon growing
+ // the array an additional 50% capacity will be allocated, plus the storage object header, taking the size of the allocation over UINT32_MAX.
+ var target = Math.floor(0xFFFFFFFF / 6);
+ // In order to force arr[target] to be stored in the vector, rather than the sparse map, we need ensure the vector is sufficiently densely populated.
+ var populate = Math.floor(target / 8 + 1);
+
+ try {
+ var arr = new Array();
+ for (i=0; i < populate; ++i)
+ arr[i] = 0;
+ arr[target] = 0;
+ } catch(e) {
+ var expect_name = "Error";
+ var expect_message = "Out of memory";
+ if ((e.name == expect_name) && (e.message == expect_message))
+ document.write("<p>SUCCESS</p>");
+ else
+ document.write("<p>FAIL - Expected \"" + expect_name + "/" + expect_message + "\", got \"" + e.name + "/" + e.message + "\".</p>");
+
+ return;
+ }
+
+ document.write("<p>FAIL - Expected exception.</p>");
+}
+
+</script>
+</head>
+<body>
+<p>This test checks that Array objects fail gracefully (throw exception) when array length grows large.</p>
+<p>This test may run for over 20 seconds on a fast machine, and will consume hundereds of MB of memory.</p>
+<input type="button" onclick="runArrayOOMTest()" value="Start">
+</body>
+</html>