diff options
Diffstat (limited to 'js/src/jit-test/tests/warp/bug1683309.js')
| -rw-r--r-- | js/src/jit-test/tests/warp/bug1683309.js | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/warp/bug1683309.js b/js/src/jit-test/tests/warp/bug1683309.js new file mode 100644 index 0000000000..097bed2622 --- /dev/null +++ b/js/src/jit-test/tests/warp/bug1683309.js @@ -0,0 +1,20 @@ +// |jit-test| slow; --ion-offthread-compile=off; --warp-async +// +// Bug 1683309: Assertion failure: [barrier verifier] Unmarked edge: JS Object 0xebbb6d1dee0 'object slot' edge to JS Object 0xebbb6d29f60, at gc/Verifier.cpp:392 +// +// The following testcase crashes on mozilla-central revision 20201217-2ab4142f19bc (debug build, run with --ion-offthread-compile=off --warp-async): + +if (helperThreadCount() > 0) { + evalInWorker(` + try{ + gczeal(4); + function f86(depth) { + var x = async target => ([]); + o62 = unescape; + x(o62.prop, o62); + f86(true + 1); + } + f86(0); + } catch (e) {} + `); +} |