summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/ion/bug1568397.js
blob: 68fd83a226d5185a8a29305c491f344292e11f53 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
// |jit-test| --setpref=property_error_message_fix=true; error:TypeError: can't access property "x"
let obj = {x: 1};
obj.x = 1.1;

function Foo(val, phase){
    if (phase == 3) {
        // Phase 3: Modify the prototype of this constructor.
        Foo.prototype.__proto__ = proto;
    }

    // Phase 4: Trigger the getter on the new proto.
    this.d;

    this.c = val;

    if (phase == 2) {
        // Phase 2: Stash |this| in a global variable.
        g_partial = this;

        // Trigger Phase 3.
        new Foo(1.1, 3);
    }
    this.b = 2.2;
}

let proto = {get d() {
    function accessC(arg){
        var tmp = arg.c;
        return tmp.x;
    }

    // Phase 5: Ion-compile |accessC|, using the stashed |this| from phase 2.
    // This is a partially initialized object with a C property but not a B
    // property.
    for (var i = 0; i < 100000; i++) {
        accessC(g_partial);
    }

    // Phase 6: call |accessC| with |this|, which is a partially initialized
    // object *without* a C (and B) property.
    x = accessC(this);
}};

// Phase 1: Warm up the |Foo| constructor with normal data.
for(let i = 0;i < 100;i++){
    new Foo(obj, 1);
}

// Trigger Phase 2.
new Foo(obj, 2);