summaryrefslogtreecommitdiffstats
path: root/js/src/tests/non262/regress/regress-554955-4.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/tests/non262/regress/regress-554955-4.js')
-rw-r--r--js/src/tests/non262/regress/regress-554955-4.js37
1 files changed, 37 insertions, 0 deletions
diff --git a/js/src/tests/non262/regress/regress-554955-4.js b/js/src/tests/non262/regress/regress-554955-4.js
new file mode 100644
index 0000000000..09713c2f97
--- /dev/null
+++ b/js/src/tests/non262/regress/regress-554955-4.js
@@ -0,0 +1,37 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 4 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+function f() {
+ return function(a) {
+ // This eval must take place before the block is cloned, when the
+ // call object is still not marked as a delegate. The scope chain
+ // purge for the JSOP_DEFVAR will not change the global's shape,
+ // and the property cache entry will remain valid.
+ eval(a);
+ {
+ let c = 3;
+ // This eval forces the block to be cloned, so its shape gets
+ // used as the property cache key shape.
+ eval('');
+ return b;
+ };
+ };
+}
+
+var b = 1;
+var g1 = f();
+var g2 = f();
+
+/* Call the lambda once, caching a reference to the global b. */
+g1('');
+
+/*
+ * If this call sees the above cache entry, then it will erroneously use the
+ * global b.
+ */
+assertEq(g2('var b=2'), 2);
+
+reportCompare(true, true);