From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 02:47:55 +0200 Subject: Adding upstream version 124.0.1. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/ion/bug1497107.js | 37 +++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 js/src/jit-test/tests/ion/bug1497107.js (limited to 'js/src/jit-test/tests/ion/bug1497107.js') diff --git a/js/src/jit-test/tests/ion/bug1497107.js b/js/src/jit-test/tests/ion/bug1497107.js new file mode 100644 index 0000000000..c3c4942f88 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug1497107.js @@ -0,0 +1,37 @@ +function makeChain(n, base) { + var curr = base; + for (var i = 0; i < n; i++) { + curr = Object.create(curr); + var propname = "level" + i; + curr[propname] = true; + } + return curr; +} + +function BaseClass() { + this.base = true; +} + +Object.defineProperty(BaseClass.prototype, "getter", {get: function() { with({}){}; return this.base; }}); + +function victim(arg) { + if (arg.getter) { + return 3; + } else { + return 4; + } +} + +let root = new BaseClass(); +let chains = []; +for (var i = 0; i < 6; i++) { + chains.push(makeChain(500, root)); +} + +with({}){}; +for (var i = 0; i < 1000 / 6; i++) { + with({}){}; + for (var j = 0; j < chains.length; j++) { + victim(chains[j]); + } +} -- cgit v1.2.3