Merging upstream version 125.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 42 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/warp/trial-inline-gc-4.js b/js/src/jit-test/tests/warp/trial-inline-gc-4.js
new file mode 100644
index 0000000000..2aecd4d371
--- /dev/null
+++ b/js/src/jit-test/tests/warp/trial-inline-gc-4.js
@@ -0,0 +1,42 @@
+// 1) Trial inline f => g1 => h.
+// 2) Make f => g1 call site polymorphic by calling f => g2.
+//    This gets rid of the ICScript::inlinedChildren_ edge.
+// 3) Restore f => g1.
+// 4) Trigger a shrinking GC from f => g1 => h (h not trial-inlined; h preserves Baseline code)
+//    This purges h's inlined ICScript.
+// 5) Call f => g1 => h (trial inlined). This must not use the discarded ICScript.
+function h(i, x) {
+    if (i === 900) {
+        // Step 4.
+        gc(this, "shrinking");
+    }
+    return x + 1;
+}
+function g2(i, x) {
+    if (i === 820) {
+        // Step 3.
+        callee = g1;
+    }
+    return h(i, x) + x;
+}
+function g1(i, x) {
+    if (i === 800) {
+        // Step 2.
+        callee = g2;
+    }
+    if (i === 900) {
+        // Step 4.
+        h(i, x);
+    }
+    return h(i, x) + x;
+}
+
+var callee = g1;
+
+function f() {
+    for (var i = 0; i < 1000; i++) {
+        callee(i, i);
+        callee(i, "foo");
+    }
+}
+f();