js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-2.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// |jit-test| --fast-warmup

function inner(i) {
  // Can't be eliminated because negative indices cause a bailout.
  arguments[i];
  arguments[i];
  arguments[i];
}

function outer(i) {
  trialInline();

  // Loop header to trigger OSR.
  for (let j = 0; j < 1; ++j) {
    inner(i);
  }
}

let count = 0;

for (let i = 0; i <= 100; ++i) {
    if (i === 50) {
      Object.defineProperty(Object.prototype, -1, {
        get() {
          count++;
        }
      });
    }
    outer(i < 100 ? i : -1);
}

assertEq(count, 3);