Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 21 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/ion/bug706692.js b/js/src/jit-test/tests/ion/bug706692.js
new file mode 100644
index 0000000000..d302545903
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug706692.js
@@ -0,0 +1,21 @@
+// |jit-test| error: TypeError
+
+// Bailout from a stack with multiple ion frames of different flavors.
+function f(obj,b,c) {
+	return obj(); // Throw error.
+}
+
+function g(f,obj) {
+	return f(obj); // Call f() with insufficient arguments, generating a RectifierFrame.
+}
+
+function h(f, g, obj) {
+	return g(f, obj); // EntryFrame. Generate a JSFrame.
+}
+
+f(); // Prime f().
+g(); // Prime g().
+var obj = new Object();
+
+h(f,g,obj);
+