test262/implementation-contributed/javascriptcore/stress/scoped-arguments-write-barrier-should-be-on-scope-object.js

//@ runDefault
// This test should not crash.

var arr = [];
let numberOfIterations = 1000;

function captureScopedArguments(i) {
    try {
        eval("arr[" + i + "] = arguments");
    } catch(e) {
    }
}

function addPointersToEdenGenObjects(i) {
    Array.prototype.push.call(arr[i], [,,]);

    try {
        Array.prototype.reverse.call(arr[i])
    } catch (e) {
    }
}

for (var i = 0; i < numberOfIterations; i++) {
    captureScopedArguments(i);
}

gc(); // Promote those ScopeArguments to the old generation.

for (var i = 0; i < numberOfIterations; i++) {
    addPointersToEdenGenObjects(i);
}

edenGC(); // Do eden GC to scan the remembered set which should include the ScopedArguments.

gc(); // Scan the ScopedArguments again. They better not point to collected objects.