diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
tree | f435a8308119effd964b339f76abb83a57c29483 /js/src/jit-test/tests/ion/bug1401014.js | |
parent | Initial commit. (diff) | |
download | firefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz firefox-26a029d407be480d791972afb5975cf62c9360a6.zip |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'js/src/jit-test/tests/ion/bug1401014.js')
-rw-r--r-- | js/src/jit-test/tests/ion/bug1401014.js | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug1401014.js b/js/src/jit-test/tests/ion/bug1401014.js new file mode 100644 index 0000000000..dd378948b0 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug1401014.js @@ -0,0 +1,52 @@ +// Prevent optimizing top-level +with ({}) { } + + +// Unboxed object constructor candidate +function Thing() { + this.a = {}; // Object || null + this.b = {}; // Object || null +} + +(new Thing()); +(new Thing()).a = null; +(new Thing()).b = null; + + +var arr = new Array(1000); +arr[0]; + +var ctx = new Thing(); + +function funPsh(t, x) { + t.a = x; +} + +function funBug(t, i) { + t.b = t.a; // GETPROP t.a + t.a = null; // SETPROP t.a + arr[i] = 0; // Bailout on uninitialized elements + return t.b; +} + +// Ion compile +for (var i = 0; i < 20000; ++i) { + funBug(ctx, 0); + funPsh(ctx, {}); +} + +// Invalidate +let tmp = { a: null, b: {} }; +funBug(tmp, 0); + +// Ion compile +for (var i = 0; i < 20000; ++i) { + funBug(ctx, 0); + funPsh(ctx, {}); +} + +// Trigger bailout +let res = funBug(ctx, 500); + +// Result should not be clobbered by |t.a = null| +assertEq(res === null, false); |