context: function test(){  enterFunc ('test');  printBugNumber (bug);  printStatus (summary);    expect = actual = 'No Crash';  var N = 1000;// Make an array with a hole at the end  var a = Array(N);  for (i = 0; i < N - 1; ++i)    a[i] = 1;// array_sort due for array with N elements with allocates a temporary vector// with 2*N. Lets create strings that on 32 and 64 bit CPU cause allocation// of the same amount of memory + 1 word for their char arrays. After we GC// strings with a reasonable malloc implementation that memory will be most// likely reused in array_sort for the temporary vector. Then the bug causes// accessing the one-beyond-the-aloocation word and re-interpretation of// 0xFFF0FFF0 as GC thing.   var str1 = Array(2*(2*N + 1) + 1).join(String.fromCharCode(0xFFF0));  var str2 = Array(4*(2*N + 1) + 1).join(String.fromCharCode(0xFFF0));  gc();  str1 = str2 = null;  gc();  var firstCall = true;  a.sort(function (a, b) {     if (firstCall) {      firstCall = false;      gc();    }    return a - b;  });  reportCompare(expect, actual, summary);  exitFunc ('test');}
meta: 10520	/local1/tlutelli/issta_data/temp/all_js/javascript/2007_temp/2007/10520/0b675418ba636127763e94e614e62364d6caa659/regress-360681-02.js/clean/js/tests/js1_5/Array/regress-360681-02.js