Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 62 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/warp/bug1876425.js b/js/src/jit-test/tests/warp/bug1876425.js
new file mode 100644
index 0000000000..aca528aac6
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug1876425.js
@@ -0,0 +1,62 @@
+// 1) Trial inline f1 => g (g1) => h.
+// 2) Set g to g2, to fail the f1 => g1 call site.
+// 3) Set g to g1 again.
+// 4) Make g1's generic ICScript trial inline a different callee, h2.
+// 5) Bail out from f1 => g1 => h.
+//
+// The bailout must not confuse the ICScripts of h1 and h2.
+
+function noninlined1(x) {
+    with (this) {};
+    if (x === 4002) {
+        // Step 4.
+        f2();
+        // Step 5.
+        return true;
+    }
+    return false;
+}
+function noninlined2(x) {
+    with (this) {};
+    if (x === 4000) {
+        // Step 2.
+        g = (h, x) => {
+            return x + 1;
+        };
+    }
+    if (x === 4001) {
+        // Step 3.
+        g = g1;
+    }
+}
+var h = function(x) {
+    if (noninlined1(x)) {
+        // Step 5.
+        bailout();
+    }
+    return x + 1;
+};
+var g = function(callee, x) {
+    return callee(x) + 1;
+};
+var g1 = g;
+
+function f2() {
+    var h2 = x => x + 1;
+    for (var i = 0; i < 300; i++) {
+        var x = (i % 2 === 0) ? "foo" : i; // Force trial inlining.
+        g1(h2, x);
+    }
+}
+
+function f1() {
+    for (var i = 0; i < 4200; i++) {
+        var x = (i < 900 && i % 2 === 0) ? "foo" : i; // Force trial inlining.
+        g(h, x);
+        noninlined2(i);
+        if (i === 200) {
+            trialInline();
+        }
+    }
+}
+f1();