From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 02:47:55 +0200 Subject: Adding upstream version 124.0.1. Signed-off-by: Daniel Baumann --- .../inline-arguments-oob-negative-index-1.js | 39 ++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-1.js (limited to 'js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-1.js') diff --git a/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-1.js b/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-1.js new file mode 100644 index 0000000000..b60140b3a6 --- /dev/null +++ b/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-1.js @@ -0,0 +1,39 @@ +// |jit-test| --fast-warmup + +function inner(i) { + // Can't be eliminated because negative indices cause a bailout. + arguments[i]; + arguments[i]; + arguments[i]; +} + +function outer(i) { + trialInline(); + + // Loop header to trigger OSR. + for (let j = 0; j < 1; ++j) { + inner(i, + // Add extra arguments to ensure we read the arguments from the frame. + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + ); + } +} + +let count = 0; + +for (let i = 0; i <= 100; ++i) { + if (i === 50) { + Object.defineProperty(Object.prototype, -1, { + get() { + count++; + } + }); + } + outer(i < 100 ? i : -1); +} + +assertEq(count, 3); -- cgit v1.2.3