From 2aa4a82499d4becd2284cdb482213d541b8804dd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 28 Apr 2024 16:29:10 +0200 Subject: Adding upstream version 86.0.1. Signed-off-by: Daniel Baumann --- .../tests/basic/testGuardCalleeSneakAttack.js | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js (limited to 'js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js') diff --git a/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js new file mode 100644 index 0000000000..87939ef992 --- /dev/null +++ b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js @@ -0,0 +1,31 @@ +function loop(f, expected) { + // This is the loop that breaks us. + // At record time, f's parent is a Call object with no fp. + // At second execute time, it is a Call object with fp, + // and all the Call object's dslots are still JSVAL_VOID. + for (var i = 0; i < 9; i++) + assertEq(f(), expected); +} + +function C(bad) { + var x = bad; + function f() { + return x; // We trick TR::callProp() into emitting code that gets + // JSVAL_VOID (from the Call object's dslots) + // rather than the actual value (true or false). + } + this.m = f; + return f; +} + +var obj = { + set m(f) { + if (f()) // Call once to resolve x on the Call object, + // for shape consistency. Otherwise loop gets + // recorded twice. + loop(f, true); + } +}; + +loop(C.call(obj, false), false); +C.call(obj, true); -- cgit v1.2.3