blob: dd378948b068f125e3fc7a5e14ade344e13120e3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
// Prevent optimizing top-level
with ({}) { }
// Unboxed object constructor candidate
function Thing() {
this.a = {}; // Object || null
this.b = {}; // Object || null
}
(new Thing());
(new Thing()).a = null;
(new Thing()).b = null;
var arr = new Array(1000);
arr[0];
var ctx = new Thing();
function funPsh(t, x) {
t.a = x;
}
function funBug(t, i) {
t.b = t.a; // GETPROP t.a
t.a = null; // SETPROP t.a
arr[i] = 0; // Bailout on uninitialized elements
return t.b;
}
// Ion compile
for (var i = 0; i < 20000; ++i) {
funBug(ctx, 0);
funPsh(ctx, {});
}
// Invalidate
let tmp = { a: null, b: {} };
funBug(tmp, 0);
// Ion compile
for (var i = 0; i < 20000; ++i) {
funBug(ctx, 0);
funPsh(ctx, {});
}
// Trigger bailout
let res = funBug(ctx, 500);
// Result should not be clobbered by |t.a = null|
assertEq(res === null, false);
|
