View All Attachments for Bug 258762

Attachment #228233
HTML file with javascrpt that reproduces the bug	text/html	2021-09-28 14:45:08 UTC	777 bytes	no flags	Details

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Array Initialization BUG</title>
</head>
<body>

<script>
    var arrays = [];

    function doOneArray() {
        var q = new Int32Array(1000000);
        arrays.push(q);
    }

    for (var i=0; i<2000; i++) {
        doOneArray();
        if (arrays.length % 100 === 0) {
            console.log('PROGRESS',arrays.length);
        }
    }

    console.log('NOW TYPE THE FOLLOWING TWO COMMANDS INTO THE CONSOLE, MANUALLY:');
    console.log('    var r = new Int32Array(38);');
    console.log('    r');
    console.log('Refresh the page and repeat.  After a few cycles, you will find that r is full of garbage - not initialized to zeros.  Takes up to 10 refreshes.');

</script>


</body>
</html>

Attachment #228345
Same repro rewritten for convenience	text/html	2021-10-02 04:37:21 UTC	953 bytes	no flags	Details

<script>
const test_slice_length = 20;

function alloc(array_length) {
  if (array_length < 2) {
    return null;
  }
  try {
    return new Int32Array(array_length);
  } catch (error) {
    if (error instanceof RangeError) {
      return alloc(array_length / 2);
    }
  }
}

function print(msg) {
  console.log(msg);
  if (document) {
    document.write(msg + '<br>');
  }
}

function test(iterations, array_length) {

  let arrays = [];

  for (let i = 0; i < iterations; i++) {

    let a = alloc(array_length);
    if (a == null) {
      print('out of memory after ' + i + ' iterations');
      return true;
    }

    if (!a.slice(0, test_slice_length).every(n => n == 0)) {
      print('found a failure case after ' + i + ' iterations: ');
      print(JSON.stringify(Array.from(a.slice(0, test_slice_length))));
      return false;
    }

    arrays.push(a);
  }

  return true;
}

if (test(100_000, 1_000)) {
  document.write('ok');
}
</script>