From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 02:47:55 +0200 Subject: Adding upstream version 124.0.1. Signed-off-by: Daniel Baumann --- .../tests/basic/testGuardCalleeSneakAttack2.js | 32 ++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js (limited to 'js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js') diff --git a/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js new file mode 100644 index 0000000000..9bf3c0c383 --- /dev/null +++ b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js @@ -0,0 +1,32 @@ +function loop(f, expected) { + // This is the loop that breaks us. + // At record time, f's parent is a Call object with no fp. + // At second execute time, it is a Call object with fp, + // and all the Call object's dslots are still JSVAL_VOID. + for (var i = 0; i < 9; i++) + assertEq(f(), expected); +} + +function C(bad) { + var x = bad; + function f() { + return x; // We trick TR::callProp() into emitting code that gets + // JSVAL_VOID (from the Call object's dslots) + // rather than the actual value (true or false). + } + if (bad) + void (f + "a!"); + return f; +} + +var obj = { +}; + +// Warm up and trace with C's Call object entrained but its stack frame gone. +loop(C.call(obj, false), false); + +// Sneaky access to f via a prototype method called implicitly by operator +. +Function.prototype.toString = function () { loop(this, true); return "hah"; }; + +// Fail hard if we don't handle the implicit call out of C to F.p.toString. +C.call(obj, true); -- cgit v1.2.3